kra23-at[.]cc

The domain kra23-at.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and is currently listed as taken offline. DNS resolution points to the Cloudflare‑owned address 188.114.97.3, which resides in the United States under ASN 13335 (Cloudflare, Inc.). The authoritative nameservers are matias.ns.cloudflare.com and nucum.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and edge services. HTTPS is presented with a Google Trust Services / WE1 certificate, confirming a valid TLS chain issued by a reputable CA, but the certificate alone does not attest to the legitimacy of the hosted content.

A request to the site returns HTTP 403 and the page title “Just a moment…”, which is typical of Cloudflare challenge pages rather than a visible phishing landing page. The site’s Gridinsoft trust score is 0 / 100, reflecting a poor reputation. It appears on one public security blocklist and has been specifically blocked by the PhishDestroy service, suggesting that threat‑intelligence feeds have identified it as malicious. VirusTotal reports that eight of ninety‑three scanners flagged the domain, providing additional independent confirmation of suspicious activity.

The available evidence points to a generic phishing operation that has already been taken offline, but the underlying infrastructure—Cloudflare edge, a publicly trusted TLS certificate, and a low‑reputation trust score—remains reusable for future campaigns. Because the content has not been publicly captured, the exact phishing vector and targeted brand cannot be confirmed at this time. Defenders should continue to block the domain at the network perimeter, add the associated IP address 188.114.97.3 to deny lists, and monitor for any re‑registration or reuse of the same nameservers. Regularly updating URL filtering and threat‑intel feeds will help capture any resurrection of the domain or its infrastructure in new malicious campaigns.