kra32cc[.]cc

kra32cc.cc is currently classified as a high‑risk generic phishing infrastructure. The domain was created on 26 March 2026 and is actively serving content as of 12 July 2026. Its risk rating is high and it appears on at least one security blocklist, indicating that defensive teams have already identified it as malicious.

The registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to Cloudflare’s network in Canada (IP 172.67.204.80) and the authoritative nameservers are aaden.ns.cloudflare.com and elinore.ns.cloudflare.com. HTTP responses return a 301 status code, suggesting a permanent redirect. The site presents a SSL certificate issued by Google Trust Services under the WE1 leaf, confirming the use of a valid TLS certificate. Threat intelligence sources list the domain on an AlienVault OTX pulse (1 pulse) and it is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 6 of 95 security vendors flag the domain as malicious.

Publicly observable data is limited to the page title “Captcha”, which provides no direct indication of the intended victim‑targeted brand or the exact phishing workflow employed. No additional details about page content, credential‑capture mechanisms, or payload delivery have been disclosed in the current intelligence set, leaving the precise attack vector uncertain.

Defenders should immediately add kra32cc.cc to deny‑list rules across perimeter firewalls, DNS resolvers, and email gateways. Continuous monitoring of DNS queries for the associated Cloudflare IP address and the two nameservers is advised to detect any pivot or re‑use of the infrastructure. Organizations should also enable URL filtering to block connections to the domain and consider sinkholing the IP range if feasible. Given the high‑risk rating and existing detections, rapid containment and user awareness messaging are recommended to mitigate potential credential harvesting.