kra-52[.]cc

This domain is flagged for credential harvesting phishing activity targeting users through a deceptive Captcha verification page. Analysis indicates the infrastructure is designed to mimic legitimate authentication challenges, tricking victims into submitting sensitive login credentials or personal information. The threat type aligns with generic_phishing but exhibits elevated risk due to its targeted social engineering approach and technical obfuscation tactics. Infrastructure analysis reveals the domain kra-52.cc was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 26, 2026, with an anomalous future creation date suggesting potential domain spoofing or registry manipulation. It resolves to IP address 172.67.190.213, hosted by Cloudflare, Inc. in Canada, leveraging Cloudflare's reverse proxy services to mask the true origin server. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security while facilitating encrypted phishing traffic. Security vendor detection shows 9 out of 95 engines flagged the domain as malicious, and it appears on one security blocklist, with additional blocking by PhishDestroy. The page title 'Captcha' further confirms the phishing theme, designed to deceive users into completing what appears to be a legitimate security verification process. Mitigation requires immediate domain blacklisting across security gateways and endpoint protection systems. Network administrators should block the IP 172.67.190.213 at the firewall level and monitor for related DNS queries to kra-52.cc. End users should be trained to recognize fake Captcha pages, particularly those appearing outside expected authentication flows or on unfamiliar domains. Security teams should investigate logs for connections to this domain or IP, focusing on credential submission attempts. Given the domain's current offline status, monitoring for re-registration or similar naming patterns (e.g., kra-XX.cc) is recommended to preempt potential resurgence of this phishing campaign.