kra50cc[.]icu

Analysis of the domain kra50cc.icu indicates it is associated with phishing activity, as evidenced by multiple technical indicators. The domain was registered on November 27, 2025, through NiceNIC International Group Co., Limited, and resolves to the IP address 185.246.128.44, hosted on AS42237 (w1n ltd) in Sweden. Nameservers ns1.offshorehosting.name and ns2.offshorehosting.name are linked to infrastructure frequently utilized for malicious purposes. As of the report date, the domain is offline, returning a 403 Forbidden HTTP status, which may suggest takedown efforts or temporary suspension.

Security vendor detections on VirusTotal show 3 out of 93 engines flagging the domain, though the specific nature of the threat (e.g., credential harvesting, malware distribution) is not explicitly detailed in available intelligence. The domain appears on one security blocklist, reinforcing its classification as malicious. Gridinsoft assigns a trust score of 0/100, further indicating high risk. No SSL certificate is present, which is atypical for legitimate sites and aligns with common phishing infrastructure patterns.

Defenders should treat this domain as compromised and block access at the network level. Given its registration age (less than eight months old) and hosting on offshore infrastructure, monitoring for reactivation or related domains using the same nameservers or IP range is recommended. The exact brand or service targeted by the phishing campaign is not confirmed in available data, so generic credential-harvesting precautions should be applied. If internal logs show prior connections to kra50cc.icu, initiate credential reset protocols for affected users and review endpoint telemetry for secondary infections.