kra-43[.]cc

Analysis indicates that kra-43.cc was registered on 26 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 172.67.192.38. The address is owned by Cloudflare, Inc. and is located in Canada. The domain uses Cloudflare’s authoritative nameservers arturo.ns.cloudflare.com and rosa.ns.cloudflare.com, and presents a TLS certificate issued by Google Trust Services under the WE1 root. An HTTP 301 redirect is observed, and the only visible page title returned is “Captcha”. No additional content has been captured, leaving the exact phishing template unknown. The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans show five out of ninety‑five security vendors flagging the site as malicious, and AlienVault OTX lists the domain in eight separate threat intelligence pulses. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Infrastructure signals point to a typical abuse of a reputable CDN for anonymity. The use of a valid SSL certificate from a well‑known certificate authority does not mitigate risk, as it can be leveraged to increase user confidence in phishing lures. The short domain age—less than four months—combined with rapid inclusion in multiple intelligence feeds suggests an actively operated campaign. Defenders should add kra-43.cc to URL filtering and DNS sinkhole policies, and ensure email security gateways block any messages containing links to this host. Continuous monitoring of outbound connections to the 172.67.192.38 address is advised, as well as periodic re‑scanning of the domain for updated malware signatures. Because the page content beyond the title “Captcha” has not been publicly recovered, analysts should treat any associated landing pages as potentially malicious until verified.