meta[.]kra37cck[.]ru

Analysis of meta.kra37cck.ru shows a confirmed phishing infrastructure that was taken offline prior to the assessment date of July 24, 2026. The domain resolves to the IPv4 address 193.105.134.30, which is geolocated to Sweden and belongs to AS42237 operated by w1n ltd. Registration details indicate the domain was provisioned through the UK-WIN registrar, confirming the ASN association with AS42237. No TLS/SSL certificate is presented for the site, meaning all HTTP traffic would have been unencrypted, a common characteristic of low‑cost phishing deployments.

The page title returned by the server, "kra45 - эталон профессионализма AT в рекламном проектировании," is Russian‑language text and does not reference a known brand, suggesting the site was likely used to target Russian‑speaking users with a generic credential‑harvest campaign. VirusTotal scans recorded 11 detections out of 95 security vendors, providing independent confirmation that the domain was associated with malicious activity. The domain appears on a single external security blocklist and is explicitly listed by PhishDestroy as a phishing resource, reinforcing its malicious classification. Gridinsoft’s trust score of 0 out of 100 further indicates a lack of legitimacy.

Current HTTP status is offline, which aligns with the "taken offline" status in the intelligence feed. Uncertainties remain regarding the exact phishing kit or template used, as no additional artifact hashes or payload samples are available. Defenders should immediately block DNS resolution for meta.kra37cck.ru at perimeter devices, add the IP address 193.105.134.30 to network‑level deny lists, and monitor for new domains that resolve to the same IP or share the AS42237 network. Continuous threat‑intel sharing with upstream providers is recommended to capture any re‑registration attempts or related infrastructure that may appear under the same registrar or hosting provider.