1kra-26-cc[.]ru

Analysis performed on 1kra-26-cc.ru as of July 24 2026 indicates that the domain is associated with a generic phishing campaign. The domain was registered on 31 January 2025 through the REGRU-RU registrar and currently resolves to the IP address 104.21.47.9, which is part of the Cloudflare network (AS13335) located in the United States. DNS resolution is served by the Cloudflare nameservers frida.ns.cloudflare.com and kianchau.ns.cloudflare.com. No SSL certificate is present, so the site is reachable only via plain HTTP, and the only observable HTTP metadata is the page title “Captcha”.

Threat intelligence signals reinforce the malicious assessment. The domain appears in two AlienVault OTX pulses, is listed on one public security blocklist, and is actively blocked by the PhishDestroy service. VirusTotal scans have returned detections from seven of ninety-three security vendors, a proportion that typically reflects phishing‑related activity. Gridinsoft assigns a trust score of 0 / 100, and the overall risk level has been classified as elevated. The current operational status is offline, preventing real‑time verification of payload or credential‑harvesting pages.

Uncertainty remains around the exact content that was served before the takedown, as the offline status precludes capture of the full HTTP response body, JavaScript, or any embedded tracking elements. The lack of an SSL certificate also limits the ability to inspect encrypted traffic should the domain become active again.

Defenders should treat 1kra-26-cc.ru as malicious. Immediate actions include adding the domain to DNS‑level deny lists, configuring firewalls or secure web gateways to block HTTP requests to the address, and monitoring the associated IP for any changes in ownership or service configuration.