krkn1[.]cc

Analysis of krkn1.cc, created on 21 February 2026 and currently active, shows that the site returns an HTTP 301 redirect and presents a page titled “Captcha”. The domain is hosted behind Cloudflare (AS13335) and resolves to the IPv6 address 2606:4700:3037::6815:2e79, indicating the use of Cloudflare’s edge network. SSL termination is performed by Google Trust Services under the WE1 certificate, and the authoritative nameservers are drew.ns.cloudflare.com and hera.ns.cloudflare.com. The registrar listed is NiceNIC International Group Co., Limited. Threat intelligence flags the domain as a generic phishing site.

It is listed on one public blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that three of ninety‑three scanning engines have flagged the domain as malicious, reinforcing the phishing assessment. The Gridinsoft trust score of 0 out of 100 further reflects a lack of trustworthiness. Detected web technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, which are typical for services that provide DDoS mitigation and CDN capabilities rather than indicating benign intent.

No additional content has been observed beyond the “Captcha” title, leaving the exact phishing payload or targeted brand undetermined. Defenders should treat krkn1.cc as high‑risk given its classification, blocklist presence, and vendor detections. Recommended actions include adding the domain to network and endpoint blocklists, configuring DNS filtering to return NXDOMAIN or sinkhole responses, and monitoring for any related IP or certificate reuse. Continuous re‑evaluation is advised, as threat actors may modify the underlying page while retaining the same infrastructure.