kra46cc[.]icu

Analysis of kra46cc.icu indicates that the domain is actively classified as a phishing resource. VirusTotal records show that seven of ninety‑five scanning engines have flagged the domain, providing independent confirmation of malicious intent. The domain resolves to IP address 185.246.128.44, which is allocated to AS42237 (w1n ltd) in Sweden, and the same IP is listed on a security blocklist and has been blocked by the PhishDestroy mitigation service. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing the low reputation assessment.

The site currently returns an HTTP 404 Not Found page title, and its operational status is reported as offline, limiting real‑time content inspection. No TLS certificate is present, meaning any traffic would be unencrypted and vulnerable to interception. Registration data reveal that the domain was created on 25 November 2025 through NiceNIC International Group Co., Limited, and it is served by the offshorehosting.name name servers (ns1.offshorehosting.name, ns2.offshorehosting.name).

While the exact phishing payload or targeted brand cannot be confirmed due to the 404 response and offline state, the convergence of multiple vendor detections, blocklist inclusion, and a zero‑trust score provides a high confidence indicator of malicious use. Defenders should immediately block both the domain and its associated IP at perimeter defenses, add the host to internal threat‑intel feeds, and monitor the registrar and name‑server pair for any re‑registration or activity that might indicate a resurgence. Continuous observation of the AS42237 prefix is advised, as the infrastructure may be reused for future campaigns.