kragek[.]abvdk[.]cn

Analysis of kragek.abvdk.cn, first observed in public threat feeds on July 24, 2026, indicates that the domain is actively used in a generic phishing campaign. The domain was registered on November 11, 2024 through Web Commerce Communications Limited and is delegated to the authoritative name servers a11.share-dns.com and b11.share-dns.net. DNS resolution points to the host address 101.251.179.35, which remains the sole IP associated with the domain in current intelligence. The domain is listed on two security blocklists and has been explicitly blocked by the PhishDestroy and SEAL blocklist services, confirming that reputable threat‑filtering platforms consider it malicious.

VirusTotal records show that the domain was scanned by 91 independent vendors; none reported a detection at the time of scanning, but the absence of detections does not constitute evidence of benign behavior and is consistent with the low‑profile nature of many phishing infrastructures. No publicly available SSL/TLS certificate details, HTTP status codes, or page title information have been disclosed, leaving the web‑service characteristics of the host unverified. Consequently, the precise content served by the domain remains unknown, and the specific lure or credential‑harvesting technique employed has not been documented.

Defenders are advised to incorporate the domain and its resolving IP address into outbound and inbound filtering rules, monitor network flows for any connections to 101.251.179.35, and maintain the domain on threat‑intelligence watchlists. Continuous re‑scanning with multi‑vendor platforms is recommended to detect any future changes in payload or detection status. Given the active blocklist status and the alignment with known phishing infrastructure patterns, the domain should be treated as a high‑confidence malicious indicator until a formal takedown is confirmed.