kra-36cc[.]com

This domain, kra-36cc.com, is identified as a generic phishing site specifically designed to impersonate the KRA36.CC cryptocurrency platform. Analysis indicates the site is currently offline, though prior activity suggests it was operational for malicious purposes. The page title explicitly mimics the legitimate platform, displaying 'KRA36.CC ✅' to deceive users into believing it is an authentic service. Infrastructure analysis reveals the domain was flagged by 9 of 95 security vendors on VirusTotal, indicating broad detection as malicious. It was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated registration likely intended to evade immediate scrutiny. The domain resolved to IP address 172.67.128.122, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin infrastructure. It appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent of the domain. The domain is currently offline, but its prior configuration and detection history warrant continued monitoring. Organizations and users are advised to block the domain at the DNS or proxy level, revoke any associated SSL certificates, and monitor for related infrastructure reuse. Security teams should correlate logs for connections to 172.67.128.122 and review transactions linked to KRA36.CC impersonation attempts. Future registrations from the same registrar or similar naming patterns (e.g., kra-[random].com) should be treated with elevated scrutiny.