kr73[.]site

kr73.site was registered on March 12 2026 through Web Commerce Communications Limited. The authoritative nameservers becky.ns.cloudflare.com and quentin.ns.cloudflare.com resolve the domain to IP 185.178.208.132, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The site was protected by Cloudflare and DDoS‑Guard, and presented a Let’s Encrypt TLS certificate. The only visible HTML element reported is the page title “Captcha”.

The domain is currently taken offline, and PhishDestroy has listed it as blocked. VirusTotal analysis shows that four of ninety‑four scanning engines flagged the domain, and a single security blocklist also contains it. Gridinsoft assigned a trust score of zero out of one hundred, indicating a high confidence of malicious intent. No additional public intelligence such as OTX references or Safe Browsing alerts is available.

The combination of recent registration, low trust score, presence on a blocklist, and multiple vendor detections suggests that kr73.site was employed for a phishing campaign, likely leveraging a captcha page to harvest credentials or to redirect victims. The lack of further content analysis means the exact phishing vector and targeted brand remain unknown. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated IP range, and consider adding the IP address to threat‑intel feeds. Because the infrastructure relies on Cloudflare, any future re‑hosting could reuse the same nameservers, so ongoing surveillance of the domain’s registration status and DNS records is recommended.