kra33[.]cc

Analysis of kra33.cc indicates a confirmed phishing domain leveraging a Captcha-themed page to deceive users. The domain, registered on February 24, 2026, through Cloudflare, Inc., currently resolves to IP 104.21.2.210 (AS13335, Cloudflare, Inc., US). Infrastructure analysis reveals Cloudflare nameservers (collins.ns.cloudflare.com, vern.ns.cloudflare.com) and technologies including Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-hosted domains. Detection data shows the domain appears on one security blocklist (PhishDestroy) and is flagged by 3 of 93 security vendors on VirusTotal, confirming malicious classification.

The HTTP status is 403 (Forbidden), and the domain is currently offline, though this may reflect takedown efforts or temporary suspension. The page title, 'Captcha,' suggests an attempt to mimic legitimate verification prompts, a tactic often used to harvest credentials or deliver malware. No specific brand target or phishing kit is identified in available intelligence, limiting attribution beyond generic phishing activity. Defenders should treat kra33.cc as a confirmed malicious domain.

Blocklist the domain and its resolving IP (104.21.2.210) at perimeter controls, including firewalls, DNS filters, and proxy servers. Monitor for internal connections to this IP or domain, particularly from endpoints exhibiting unusual Captcha-related pop-ups or redirects. Given the Cloudflare hosting, additional scrutiny of domains sharing the same nameservers or IP range may identify related threats. The domain's short lifespan (5 months) aligns with typical phishing campaign timelines, warranting retrospective log analysis for prior activity.