kraoi[.]com

Analysis of kraoi.com shows a newly registered domain (creation date March 12, 2026) that resolves to the Cloudflare‑owned address 188.114.96.3, ASN 13335, located in the United States. The site was protected by Cloudflare SSL, presenting a Managed CA certificate (SHA‑1 fingerprint 1f7bed55a379bd5f2f53b866b0cbbf89) and enforcing HSTS. HTTP/3 was observed, along with client‑side frameworks Vue.js and Swiper, and Cloudflare Browser Insights telemetry. The page title returned by the server is "Welcome to AI Stock," indicating an attempt to lure victims with a financial‑themed lure, though no specific brand beyond the generic term "AI Stock" is identified.

The domain’s MX record points to mail.emb666.com (priority 1), and the registrar is listed as Gname.com Pte. Ltd. Nameserver delegation uses sharon.ns.cloudflare.com and sterling.ns.cloudflare.com, both Cloudflare‑managed. VirusTotal scans recorded two detections out of ninety‑four security vendors, and the domain appears on three public blocklists, with explicit blocks from PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The site is currently taken offline, but its infrastructure—particularly the shared Cloudflare IP and the use of generic front‑end libraries—suggests it could be re‑hosted quickly.

Defenders should add kraoi.com, its resolved IP 188.114.96.3, and associated MX host mail.emb666.com to outbound and inbound block lists, monitor DNS queries for re‑registration of the same name or similar aliases, and incorporate the observed SSL fingerprint and technology stack into detection rules. Continuous threat‑intel feeds should be consulted for any resurgence, and any emails originating from the listed MX host should be scrutinized for phishing content. The limited detection count indicates early exposure; proactive containment now can prevent future credential‑harvesting campaigns.