kra--34[.]cc

This domain, kra--34.cc, is currently flagged as an active high-risk phishing site specializing in generic credential harvesting. Infrastructure analysis reveals the domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and is hosted behind Cloudflare’s network, resolving to IP address 188.114.97.3 (AS13335, Canada). The site presents a page titled 'Captcha,' a common tactic used to filter automated security scans or create a false sense of legitimacy before redirecting victims to malicious content. No specific brand impersonation or phishing kit is confirmed in available data, though the page title suggests an attempt to manipulate user trust. The domain is protected by Cloudflare nameservers (aaden.ns.cloudflare.com, elinore.ns.cloudflare.com) and uses a Google Trust Services SSL certificate (WE1), which provides encryption but does not validate the site’s legitimacy. It is actively blocked by at least one security provider (PhishDestroy) and appears in eight threat intelligence pulses on AlienVault OTX, indicating prior detection by the security community. Four of ninety-four security vendors on VirusTotal flag the domain as malicious, though the absence of detections from other vendors does not confirm safety. Defenders should treat this domain as hostile due to its recent registration, Cloudflare proxying, and confirmed presence on multiple threat feeds. Network-level blocking is recommended, particularly for organizations vulnerable to credential theft. Further analysis of the site’s content or backend infrastructure may reveal additional indicators, but current evidence supports immediate containment.