kra18-19[.]cc

Analysis conducted on 23 July 2026 identifies kra18-19.cc as an inactive domain that was previously used for generic phishing. The domain was registered on 29 March 2026 through Gname 222 Inc and is hosted on Cloudflare’s network, as indicated by the authoritative name servers amanda.ns.cloudflare.com and paul.ns.cloudflare.com. HTTP requests to the site return a 403 Forbidden response, and the domain has been taken offline, a status confirmed by multiple monitoring services. Threat intelligence sources have placed the domain on a single security blocklist and PhishDestroy has recorded it as blocked.

VirusTotal scans show that six of ninety‑four antivirus and URL‑reputation vendors flagged the domain, providing independent corroboration of malicious intent. No additional evidence such as SSL certificates, page titles, or content snapshots is available, and the lack of observed traffic prevents a full infrastructure profile. Consequently, the primary indicators are the registration details, Cloudflare name servers, the 403 HTTP status, blocklist inclusion, and the partial detection record on VirusTotal.

Defenders should continue to block kra18-19.cc at perimeter filters, update URL reputation lists, and monitor for any resurrection of the domain or related sub‑domains. Because the site is offline, active mitigation is limited to preventative controls; however, the presence of the domain on blocklists and the vendor detections suggest that it was actively leveraged in phishing campaigns before being shut down. Ongoing observation of the registrar Gname 222 Inc and Cloudflare name server patterns may reveal future abuse.