krac1[.]cc

Analysis indicates that the domain krac1.cc was registered on 30 October 2025 through Gname.com Pte. Ltd. The authoritative name servers are dean.ns.cloudflare.com and liz.ns.cloudflare.com, pointing to the Cloudflare network (ASN 13335) with the IP address 172.67.201.59 located in the United States. The site presented an HTTP 403 response and a page title of "Captcha". The TLS certificate is issued by Let’s Encrypt (CN=E8), confirming that the domain had active HTTPS at the time of observation. VirusTotal records show that five of ninety‑three scanned security vendors flagged the domain as malicious, and the domain appears on at least one external blocklist.

PhishDestroy has also listed the domain as blocked, and the current operational status is offline. The combination of recent registration, use of Cloudflare’s edge services, a minimal HTTP response, and the presence of a captcha‑related title is consistent with a generic phishing infrastructure that attempts to evade automated crawlers. However, the limited public evidence—no disclosed landing page content, no specific brand targeting, and no observed payload—prevents a definitive attribution of the phishing technique employed. The domain’s short lifespan and immediate takedown suggest a rapid‑deployment campaign.

Defenders should add krac1.cc and its associated IP address 172.67.201.59 to network‑level deny lists, monitor DNS queries for the domain and its Cloudflare name servers, and enforce TLS inspection policies to capture any future encrypted traffic. Continuous monitoring of Cloudflare‑hosted IP ranges for similar short‑lived domains is advised. Organizations using web‑filtering solutions should ensure that the domain is blocked across all proxy and endpoint protection layers. Incident response teams should treat any observed traffic to krac1.cc as suspicious and trigger appropriate investigation procedures.