kra--38[.]cc

Analysis of kra--38.cc shows a newly registered domain (created March 26, 2026) that is currently active and serves a generic phishing page titled "Captcha". The site returns an HTTP 301 redirect and is protected by a SSL certificate issued by Google Trust Services under the WE1 authority. Infrastructure clues indicate the domain resolves to IP 104.21.51.194, which belongs to Cloudflare, Inc. in Canada, and uses Cloudflare nameservers aaden.ns.cloudflare.com and elinore.ns.cloudflare.com. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the domain has a Gridinsoft trust score of 0/100, reflecting a high‑risk assessment. Threat intelligence flags the site as a Brand Impersonation scam; it is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal scans report 8 of 94 security vendors flagging the domain as malicious, and AlienVault OTX includes it in a single threat pulse. Given the combination of a low trust score, active blocklist presence, and multiple vendor detections, defenders should immediately block DNS resolution for kra--38.cc, monitor for any related C2 traffic, and consider adding the IP address 104.21.51.194 to network deny lists. Continuous observation is advised to detect any evolution of the payload or additional infrastructure components.