kra34at[.]com

The domain kra34at.com was registered on May 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Cloudflare address 104.21.53.65, which is geolocated to Canada. The authoritative nameservers are princess.ns.cloudflare.com and sterling.ns.cloudflare.com, and the site presents a SSL certificate issued by Google Trust Services under the WE1 label. An HTTP 301 response redirects requests, and the page title returned is "kra34.at". The domain is explicitly linked to a brand impersonation campaign targeting the brand kra34, classified as a phishing_login type.

Infrastructure analysis shows that the domain is currently listed on a single security blocklist and has been cited in one AlienVault OTX pulse. PhishDestroy has blocked the domain, and VirusTotal reports a single positive detection out of 95 security vendors. The Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious intent. Despite these indicators, the domain remains active as of the report date, suggesting that the threat actor is still operating the site.

Defenders should prioritize immediate blocking of kra34at.com at network and proxy layers, given its confirmed impersonation of a legitimate brand and the presence of a positive detection on VirusTotal. Monitoring for DNS queries to the associated Cloudflare IP address (104.21.53.65) can help identify compromised internal hosts attempting to reach the malicious site. Organizations using the kra34 brand should alert users to the existence of this domain and reinforce verification procedures for login requests. Continuous ingestion of threat feeds that reference the domain’s blocklist status and OTX pulse will ensure that any future changes in detection counts are promptly reflected in security controls.