kra121[.]cc

Analysis of kra121.cc shows a newly created infrastructure that aligns with known generic phishing patterns. The domain was registered on October 09, 2025 through Dynadot LLC and is hosted on Cloudflare’s network (ASN13335) with the IP address 172.67.160.208 located in the United States. Both authoritative nameservers, tosana.ns.cloudflare.com and ziggy.ns.cloudflare.com, point to Cloudflare, a common choice for fast‑flux or proxy‑based abuse because it masks the true origin of malicious traffic. No TLS certificate is presented, meaning the site does not support HTTPS and cannot provide transport‑layer security.

The page title returned by the server is "kra46.cc," a different domain, suggesting a possible redirect or placeholder that may have been used to obscure the target URL. VirusTotal scans have flagged the domain in three of ninety‑five vendor engines, and the domain is listed on one security blocklist, indicating that multiple security products have observed malicious behavior associated with it. PhishDestroy has also blocked the domain, reinforcing the perception of phishing intent. Gridinsoft’s trust score of 0 out of 100 reflects an extremely low reputation.

Current status is offline, but the underlying DNS records and hosting remain active, allowing rapid re‑activation. Defenders should continue to block the domain at perimeter and endpoint layers, monitor the associated IP for any resumed activity, and consider adding the IP and nameserver entries to threat intelligence feeds. Ongoing observation is advised to detect any future re‑deployment or changes to the site’s content, given the recent registration date and the low trust metrics.