kra-cc[.]com

Analysis of the domain kra-cc.com indicates active credential phishing infrastructure as of July 12, 2026. The domain was registered on March 29, 2026, through DomainsAreForever.net LLC and currently resolves to the IP address 76.223.54.146, which is associated with AWS Global Accelerator in the United States. Infrastructure analysis reveals the use of nameservers ns1.afternic.com and ns2.afternic.com, alongside a verification-specific nameserver (verification-d3jclucsp89ganyqbydeny.ns), suggesting a structured deployment likely intended to evade detection or automate domain validation. The domain is flagged by 13 of 94 security vendors on a recent scan, with a trust score of 0/100 from Gridinsoft. It appears on a single security blocklist and has been identified in one threat intelligence pulse within AlienVault OTX. The SSL certificate, issued by GoDaddy.com via the GoDaddy TLS Intermediate CA DV - R1v1, remains valid, which may lend a superficial appearance of legitimacy to potential victims. The domain returns an HTTP 200 status, confirming its operational status at the time of assessment. No specific brand impersonation or phishing kit has been conclusively identified in the available data. The exact content and targeting methodology of the phishing pages remain unanalyzed; however, the domain’s infrastructure and detection profile align with credential harvesting campaigns. Defenders are advised to block the domain and its resolving IP address (76.223.54.146) at the network level. Monitoring for related domains registered through the same registrar or utilizing similar nameserver patterns may aid in identifying additional threats within this campaign.