kra26a[.]cc

This domain, kra26a.cc, was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains active as of July 12, 2026. Infrastructure analysis reveals the site is fronted by Cloudflare, utilizing HTTP/3 and Cloudflare Browser Insights for performance monitoring, while resolving to IP address 172.67.198.66. The SSL certificate is issued by Google Trust Services, a common but not exclusive indicator of legitimacy. The page title, 'Kra26.сс – Безопасный доступ без ограничений,' suggests a Russian-language phishing portal promising unrestricted or secure access, though the specific target or service being impersonated is not confirmed in available data. The domain appears on two security blocklists and is referenced in 22 threat intelligence pulses on AlienVault OTX, indicating prior detection by multiple independent sources. Fourteen of 95 security vendors on VirusTotal flag the domain as malicious, though the nature of the threat—whether credential harvesting, malware distribution, or another attack vector—remains unclassified. The domain has been actively blocked by at least two security platforms, reinforcing its high-risk designation. Defenders should treat this domain as an active phishing threat, particularly for Russian-speaking users, and prioritize blocking or monitoring traffic to 172.67.198.66. Given the use of Cloudflare, additional scrutiny of TLS handshakes and HTTP/3 traffic may be required to identify malicious sessions. Further analysis of the site’s content is needed to determine the exact phishing kit or brand impersonation, if any.