kra0[.]org

The domain kra0.org was registered on 2025-11-16 via Gname.com Pte. Ltd. It resolves to 172.67.201.59, an address owned by Cloudflare (AS13335) located in the United States. No TLS certificate is presented, indicating HTTP‑only service. The only visible page title is “Captcha”, and no further content has been captured. Gridinsoft assigns a trust score of 0/100, effectively marking the domain as malicious.

VirusTotal reports that 4 of 93 scanned security vendors flagged the domain, reinforcing the suspicion. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy filtering service. Nameserver records point to ariadne.ns.cloudflare.com and viddy.ns.cloudflare.com, confirming Cloudflare DNS usage. The site is currently taken offline, which limits real‑time observation but does not remove the historical indicators of abuse.

Evidence is limited to registration metadata, hosting information, the low trust score, and the modest vendor detections; no malware payloads, phishing page screenshots, or credential‑harvesting URLs have been disclosed. Defenders should continue to block kra0.org at perimeter filters, update URL reputation feeds, and monitor for re‑use of the underlying IP address or Cloudflare nameservers in future campaigns. Additional investigation should focus on any residual HTTP requests that may still target the domain and on correlating the four vendor detections to identify the specific malicious behaviors observed.