kra---46[.]cc

Analysis of kra---46.cc shows a newly registered domain (creation date Nov 23 2025) that was used to impersonate the Instagram brand. The site resolved to IP 172.67.158.2, which belongs to AS13335 (Cloudflare, Inc.) and was served from Cloudflare’s network in the United States. No TLS certificate was presented, indicating the site operated over plain HTTP before being taken offline. The authoritative nameservers listed are amos.ns.cloudflare.com and kay.ns.cloudflare.com, confirming the Cloudflare hosting relationship.

The page title captured during the brief observation reads “kra46 мотороллер cc объема at и kra47 мопед cc вида at — магазин KRA CC в России,” a Russian‑language phrase unrelated to Instagram, suggesting the page content was either a placeholder or a low‑quality copy‑paste. The domain is flagged by a single security blocklist and was specifically added to PhishDestroy’s list of malicious sites. Gridinsoft assigned a trust score of 0 / 100, reflecting an extremely low confidence in the site’s legitimacy. VirusTotal scans reported eight detections out of ninety‑five participating vendors, providing additional independent confirmation of malicious intent.

The registrar listed is Gransy, s.r.o., a known bulk‑registration service. Current status is offline, but historical activity indicates the domain was used for brand impersonation targeting Instagram users. Defenders should block the domain at perimeter firewalls, update DNS sinkhole lists, and monitor for any residual traffic to the associated Cloudflare IP range. Incident response teams should also review logs for connections to 172.67.158.2 during the active window and consider adding the domain to internal threat intelligence feeds to prevent re‑use by threat actors.