kra48cc[.]com

The domain kra48cc.com was registered on 27 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The zone is delegated to Cloudflare nameservers olga.ns.cloudflare.com and reese.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. The site presents a TLS certificate issued by Google Trust Services under the WE1 identifier, confirming that HTTPS is enforced.

Network resolution points to the IP address 104.21.56.202, which belongs to Cloudflare, Inc. and is geolocated to Canada. HTTP requests receive a 301 redirect response, and the landing page title is reported as “Captcha”, a common tactic to filter automated traffic before presenting a malicious payload. Gridinsoft assigns the domain a trust score of 0 out of 100, and it appears on a single security blocklist, reflecting a high risk perception despite the lack of detections on mainstream scanning services.

The domain is listed in one AlienVault OTX pulse and is actively blocked by the PhishDestroy blocklist, confirming that threat‑intel communities have observed malicious activity associated with this host. The current risk level is marked under investigation, and the site remains active as of the report date. While the page title and infrastructure suggest a credential‑harvesting operation, no specific phishing kit, targeted brand, or payload hash has been publicly disclosed, leaving the exact attack vector ambiguous.

Defenders should add kra48cc.com to network and endpoint blocklists, enforce DNS sinkholing for the domain, and monitor outbound connections to the associated Cloudflare IP. Continuous observation of the domain’s DNS records is advised, as the underlying IP may change under Cloudflare’s load‑balancing. Organizations should also educate users about unexpected captcha challenges that may precede credential‑stealing pages, and apply standard phishing‑mitigation controls such as MFA and URL reputation filtering.