kra43-at[.]com

Analysis of the domain kra43-at.com indicates it is an active phishing infrastructure first observed on March 27, 2026. The domain presents a page titled 'Captcha', a common tactic used to deceive users into interacting with fraudulent content under the guise of a security verification process. Infrastructure review shows the domain is proxied through Cloudflare nameservers (arturo.ns.cloudflare.com and rosa.ns.cloudflare.com) and resolves to the IP address 188.114.97.3, which is geolocated in Canada and associated with Cloudflare's network. A 301 HTTP redirect is currently in place, suggesting the domain may be part of a larger redirection chain leading to malicious endpoints. Security vendors have flagged this domain, with four out of ninety-four engines on VirusTotal detecting it as malicious. It also appears on one security blocklist and has been included in a threat intelligence pulse on AlienVault OTX. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in fraudulent domain registrations. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate malicious intent but is consistent with phishing campaigns leveraging legitimate certificate authorities to appear trustworthy. Defenders should treat kra43-at.com as high-risk due to its confirmed presence on blocklists, detection by multiple security engines, and active status. The use of Cloudflare infrastructure complicates direct attribution but does not mitigate the threat. Network-level blocking is recommended, along with monitoring for related domains using the same nameserver or IP infrastructure. The exact brand or service being impersonated is not yet confirmed, as the page title alone does not provide sufficient detail. Further analysis of the redirect target or associated payloads may clarify the specific phishing campaign.