kra4[.]vip

Analysis conducted on July 19, 2026 identifies kra4.vip as an active phishing domain registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain currently resolves to the IP address 188.114.96.3, which is geolocated to Canada and associated with CloudFlare, Inc. infrastructure. Nameservers ernest.ns.cloudflare.com and lucy.ns.cloudflare.com further confirm Cloudflare hosting, a common tactic to obscure origin and evade takedowns. The domain appears on one security blocklist maintained by PhishDestroy and has been referenced in two threat intelligence pulses on AlienVault OTX, indicating prior detection by security researchers. No vendor detections were recorded at the time of the most recent VirusTotal scan, though this does not confirm the domain’s safety or legitimacy. The SSL certificate is issued by Google Trust Services, specifically the WE1 intermediate, which is consistent with Cloudflare’s managed certificate service. The domain returns an HTTP 301 redirect, suggesting it may be part of a larger redirection chain leading to a credential-harvesting page or other malicious endpoint. The exact target brand or service being impersonated has not yet been confirmed through content analysis. Defenders are advised to monitor network traffic for connections to 188.114.96.3 and kra4.vip, and to review logs for HTTP 301 redirects originating from this domain. Blocklisting at the DNS or proxy level is recommended pending further analysis. Given the domain’s presence on a security blocklist and its association with known phishing infrastructure, organizations should treat it as high-risk until additional evidence confirms otherwise.