kra--58[.]cc

The domain kra--58.cc is currently classified as a high‑risk generic_phishing site. It was created on 26 March 2026 and remains active as of 12 July 2026. VirusTotal reports that nine of ninety‑five scanned security vendors flag the domain, and AlienVault OTX has referenced it in eight separate threat‑intel pulses. These indicators collectively support a phishing designation. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, which is hosted by CloudFlare, Inc. in Canada. The SSL certificate is issued by Google Trust Services under the WE1 label, confirming the use of a legitimate TLS chain. Nameserver delegation points to miguel.ns.cloudflare.com and raquel.ns.cloudflare.com, both CloudFlare authoritative servers. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, consistent with a recent bulk‑registration profile. Web interaction is limited to an HTTP 301 redirect that ultimately serves a page titled “Captcha”. The site is listed on a single security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating no confidence in the site's legitimacy. The combination of a generic captcha page, redirection behavior, and low trust metrics aligns with typical credential‑harvesting tactics. Defenders should treat kra--58.cc as a malicious host. Immediate mitigation includes adding the domain and its resolving IP 188.114.96.3 to outbound deny lists, enforcing DNS sink‑hole rules for the associated CloudFlare nameservers, and monitoring for any attempted connections from internal assets. Continuous threat‑intel feeds should be consulted for updates, and any observed credential submissions to the site should be investigated as potential compromise.