kra40-at[.]net

Analysis of kra40-at.net indicates that the domain was created on August 21, 2025 and is currently taken offline. The site was hosted behind Cloudflare, using the nameservers bella.ns.cloudflare.com and jihoon.ns.cloudflare.com, and resolved to the IP address 198.18.1.227. TLS termination was provided by a Google Trust Services certificate issued under the WE1 authority, and the service supported HTTP/3. The page title returned by the server – "Kra40 at — Актуальная рабочая ссылка" – is the only visible content captured; no additional page metadata or content has been disclosed.

Security intelligence shows that the domain is listed on a single blocklist operated by PhishDestroy, and a Gridinsoft trust score of 0 out of 100 reinforces the assessment of high malicious confidence. VirusTotal scans recorded six positive detections out of ninety‑five submitted security vendors, confirming that multiple reputable scanners flagged the domain as malicious. Registration was performed through NiceNIC International Group Co., Limited, a registrar that does not appear to be associated with any benign activity for this host.

The combination of a low trust score, multiple vendor detections, and blocklist inclusion suggests that kra40-at.net was used for a generic phishing campaign, although the exact target or credential‑harvesting vector cannot be confirmed from the limited page title. Defenders should continue to block the domain at perimeter and endpoint controls, monitor DNS queries for the associated IP and Cloudflare nameservers, and consider adding the domain to internal blocklists. Ongoing observation of any re‑registration attempts or changes to the hosting configuration is advised, as the current offline status does not preclude future reuse by threat actors.