kra25-c[.]cc

The domain kra25-c.cc is currently active and has been categorized as a high-risk generic phishing threat. Analysis reveals that this domain was created on March 12, 2026, and it is registered through NiceNIC International Group Co., Limited. The domain's trust score, as assessed by Gridinsoft, stands at 0 out of 100, indicating a complete lack of trustworthiness. The domain resolves to the IP address 104.21.7.55 and utilizes a Google Trust Services SSL certificate, which although provides encryption, does not confer legitimacy in this context.

Further investigation shows that kra25-c.cc is flagged by 14 out of 95 security vendors on VirusTotal, suggesting significant malicious activity associated with this domain. Additionally, it has been noted in 23 threat intelligence pulses on AlienVault OTX, further corroborating its involvement in phishing-related activities. The domain also appears on four security blocklists, including those maintained by SEAL, MetaMask, PhishDestroy, and BLP-Malware, which indicates that multiple security entities have identified it as a threat.

The technologies detected on this domain include Cloudflare Browser Insights and HTTP/3, which are commonly used for performance optimization but can also be misused by malicious actors to obscure their activities. Given the combination of these factors, defenders should prioritize monitoring and blocking this domain to prevent potential phishing attempts targeting users. It is crucial to inform users about the risks of engaging with this domain and to advise them to remain vigilant against phishing attempts, especially those that may appear legitimate due to the presence of SSL security.