kra-38[.]cc

This domain, kra-38.cc, is actively conducting phishing operations by mimicking Cloudflare's "Attention Required" verification page. The site likely targets users attempting to access legitimate services, redirecting them to fraudulent pages designed to harvest credentials or personal information under the guise of security validation. The use of Cloudflare's infrastructure (AS13335) and a legitimate-looking SSL certificate (Google Trust Services WE1) increases the deception's credibility, making it more effective against unsuspecting victims. Analysis indicates kra-38.cc was registered on December 10, 2024, through NiceNIC International Group Co., Limited. It currently resolves to IP address 172.67.137.166 and appears on one security blocklist. VirusTotal detection shows 15 out of 95 security vendors flag this domain as malicious, with the page title explicitly matching Cloudflare's standard verification prompt. The domain's infrastructure leverages Cloudflare's network, which may help evade basic reputation checks by blending with legitimate traffic. Users who visited kra-38.cc should immediately terminate any active sessions and avoid entering credentials or personal data. Clear browser cache and cookies to remove potential tracking elements. If credentials were submitted, reset passwords for all accounts accessed from the same device, enable multi-factor authentication where available, and monitor for unauthorized activity. Network administrators should block the domain and its resolving IP (172.67.137.166) at the firewall level to prevent further exposure within their environments.