kra40cc[.]com

The domain kra40cc.com was registered on April 25, 2026 via Afterdark Domains, LLC and is currently classified as a high‑risk generic phishing site. Analysis indicates that the domain is actively serving content, returning HTTP status 200, and is listed as active in threat intelligence feeds. The short lifespan of the domain combined with its immediate appearance on a security blocklist suggests an automated deployment of a phishing kit aimed at credential harvesting.

Infrastructure analysis shows that kra40cc.com resolves to the IP address 13.248.169.48, which is hosted in Canada and associated with an AWS Global Accelerator service. The SSL certificate is issued by GoDaddy.com under a DV Intermediate CA, confirming that standard TLS is in place but offering no indication of malicious intent. The domain’s presence on a single blocklist and its identification by PhishDestroy demonstrate that it has already attracted defensive attention, yet the underlying hosting infrastructure remains publicly reachable.

Detection metrics reinforce the malicious profile: Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of reputation. VirusTotal records 16 positive detections out of 95 security vendors, confirming that multiple scanners have identified suspicious or malicious characteristics. These concrete signals, together with the high‑risk rating, provide a robust basis for defensive action.

Defenders should prioritize immediate blocking of the domain and its associated IP address at perimeter and DNS layers. Continuous monitoring for new sub‑domains or IP rotations is advised, as phishing operators often shift infrastructure to evade takedown. Incorporating the observed TLS fingerprint and HTTP response pattern into intrusion detection signatures will improve early detection. Organizations should also educate end‑users about the typical look‑and‑feel of credential‑harvesting pages, as technical controls alone may not fully mitigate exposure.