kra--37[.]cc

Analysis of kra--37.cc indicates an active phishing infrastructure leveraging Cloudflare for hosting and traffic redirection. The domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to IP 172.67.161.129, geolocated to Canada under Cloudflare's network. Nameservers are set to aaden.ns.cloudflare.com and elinore.ns.cloudflare.com, confirming Cloudflare DNS management. The domain returns an HTTP 301 redirect status, suggesting it is designed to forward visitors to another destination, though the final target remains unconfirmed. The page title, 'Один момент…', is a generic Russian placeholder commonly used during page loading or redirection, offering no direct indication of a specific brand or service being impersonated. No phishing kit or targeted brand has been identified in available intelligence. The domain appears on one security blocklist (PhishDestroy) and is referenced in eight threat intelligence pulses on AlienVault OTX, indicating prior detection in malicious campaigns. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. SSL inspection reveals a valid certificate issued by Google Trust Services (WE1), a practice consistent with both legitimate and malicious domains attempting to evade browser warnings. While VirusTotal shows minimal vendor detection (1/94), this does not imply safety, as phishing domains often evade initial scans before wider detection occurs. Defenders should treat this domain as active and malicious, particularly in environments where Russian-language redirection or Cloudflare-hosted phishing is a known threat vector. Blocking the domain at DNS or proxy level is recommended, along with monitoring for related infrastructure using the same nameservers or IP range. Further analysis of redirect chains may reveal additional malicious endpoints.