kra[.]31[.]cc

This domain is flagged as a generic phishing threat with an elevated risk classification. Analysis indicates the infrastructure is designed to impersonate legitimate domain trading services, as evidenced by the page title referencing 'Guta.com' domain exchange functions, including domain sales, purchases, and brokerage services. The fraudulent intent is further supported by the use of deceptive branding elements to lure victims into disclosing sensitive account credentials or financial information. Infrastructure analysis reveals the following technical indicators: the domain kra.31.cc was registered on March 28, 2026, through eName Technology Co., Ltd. It resolves to the IP address 43.155.109.138 and employs a Let's Encrypt SSL certificate. Security vendor detections on VirusTotal show 7 out of 95 engines flagging the domain, while it appears on one security blocklist. The Gridinsoft trust score for this domain is 0 out of 100, indicating no established reputation or trustworthiness. The domain has since been taken offline, though residual risk remains for systems previously exposed. Mitigation for this specific threat type involves several technical controls. Network administrators should verify that endpoint protection systems have updated signatures to detect and block this domain and its associated IP address. User awareness training should emphasize the risks of interacting with unsolicited domain trading offers, particularly those received via email or messaging platforms. Organizations operating domain registration or trading services should implement multi-factor authentication for account access and monitor for unauthorized transactions. Security teams should review logs for any prior connections to 43.155.109.138 or kra.31.cc and investigate potential credential exposure. Domain registrars and hosting providers should be notified of fraudulent infrastructure to facilitate takedown procedures.