kra--37-cc[.]cc

This domain, kra--37-cc.cc, is flagged as an active phishing threat targeting users of SLON2, a cryptocurrency platform referenced in the page title (SLON2.AT | SLON2.CC | SLON2.TO). Analysis indicates the domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, and remains operational as of July 13, 2026. Infrastructure analysis reveals Cloudflare nameservers (jerry.ns.cloudflare.com, rachel.ns.cloudflare.com) and the use of Cloudflare Browser Insights with HTTP/3 support, a common configuration for both legitimate services and malicious campaigns seeking to evade detection. The domain appears on three security blocklists and is actively blocked by at least three security providers, including MetaMask, a cryptocurrency wallet service, suggesting a focus on crypto-related fraud. While the page title explicitly references SLON2, the exact nature of the phishing scheme—whether credential harvesting, crypto drainer, or fake token distribution—remains unconfirmed due to the absence of deeper content analysis. Four of 93 security vendors on VirusTotal have flagged the domain, though this detection rate should not be interpreted as conclusive evidence of its threat level. Defenders should treat this domain as high-risk, particularly in environments where cryptocurrency transactions or SLON2-related services are accessed. Monitoring for connections to this domain, especially those originating from browser-based crypto wallet extensions, is recommended. The 302 HTTP status suggests potential redirection chains, which may obscure the final malicious payload. Further investigation into associated IP addresses and historical DNS records could reveal additional infrastructure linked to this campaign.