kr63[.]site

Analysis of kr63.site indicates an active phishing infrastructure leveraging Cloudflare services. The domain, registered on March 11, 2026, through Web Commerce Communications Limited, currently resolves to IP address 172.67.173.63 (AS13335, Cloudflare, Inc., United States). Infrastructure review shows the domain uses Cloudflare nameservers (becky.ns.cloudflare.com and quentin.ns.cloudflare.com) and presents a 301 HTTP redirect status, suggesting it may serve as an intermediary or gateway to further malicious endpoints. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for domains utilizing Cloudflare's proxy services. Security vendor detection remains limited, with 3 of 94 engines on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The page title, 'kr69.site,' does not provide conclusive evidence of the specific brand or service being impersonated, and no confirmed phishing kit or target has been identified in available data. The exact content and functionality of the site remain unanalyzed, though the 301 redirect behavior is consistent with phishing campaigns that route victims through multiple domains to evade detection. Defenders should treat this domain as high-risk due to its active status, Cloudflare-hosted infrastructure, and presence on security blocklists. Network-level blocking of 172.67.173.63 and monitoring for connections to kr63.site are recommended. Further investigation into associated domains, particularly kr69.site, may reveal additional components of this phishing operation. No evidence currently suggests this domain is part of a larger, previously documented campaign, but its recent registration and use of redirect mechanisms warrant continued scrutiny.