krak25[.]com

The domain krak25.com was registered on April 13, 2026 through Aconcagua Domains LLC and remains active as of the assessment date. It appears on a single security blocklist and has been explicitly flagged by PhishDestroy. The Gridinsoft trust scoring system assigns it a score of 0 out of 100, indicating an extremely low reputation. The high‑risk classification aligns with the observed generic phishing activity associated with the domain.

Infrastructure analysis shows the domain resolves to the IP address 76.223.54.146, which is hosted behind an AWS Global Accelerator endpoint identified as "GLOBAL" and geo‑located within the United States. The TLS certificate is issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV - R1v1 chain, providing a valid HTTPS response with an HTTP status code of 200. These characteristics are typical of infrastructure leveraged to mask malicious activity while maintaining a legitimate‑looking surface.

Threat intelligence sources reinforce the concern: AlienVault OTX lists the domain in one pulse, and VirusTotal records two of ninety‑five security vendors flagging the domain as malicious. The presence on PhishDestroy’s blocklist further corroborates its use in phishing campaigns. Combined with the zero trust score, the evidence supports a high‑risk rating for this domain.

Defenders should treat krak25.com as a confirmed phishing vector. Immediate actions include adding the domain to deny‑list controls at the DNS, proxy, and email gateway layers, and monitoring for any outbound connections to the associated IP address. Because the site content has not been publicly analyzed, additional investigation of the landing pages is advisable to determine the specific phishing tactics employed. Continuous monitoring of threat feeds for new indicators tied to this domain is recommended to maintain up‑to‑date protection.