kra39-at[.]cc

The domain kra39-at.cc was registered on 19 January 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is hosted behind Cloudflare, as indicated by the authoritative nameservers shaz.ns.cloudflare.com and yadiel.ns.cloudflare.com, and resolves to the Cloudflare‑owned address 104.21.81.180 located in Canada. The site presents a page title “KRA39.cc - KRA39.at”, suggesting a possible attempt to mimic a legitimate brand or service.

Analysis classifies the site as a generic phishing infrastructure. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, confirming its malicious intent. The HTTP response is a 301 redirect, which is commonly used to forward victims to credential‑harvesting pages while obscuring the original URL. The presence of Cloudflare Browser Insights and HTTP/3 indicates that the operators are leveraging modern CDN features to improve performance and evade detection.

VirusTotal scans have flagged the domain in 15 of 95 security vendor checks, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The TLS certificate is issued by Google Trust Services under the WE1 designation, which is typical for Cloudflare‑proxied sites and does not provide any reassurance about the underlying content. The combination of a high‑risk blocklist status, low trust score, and multiple vendor detections points to an active phishing campaign.

Defenders should add kra39-at.cc to network‑level deny lists and block outbound connections to its resolving IP 104.21.81.180. Monitoring for any HTTP 301 redirects to this domain can help identify compromised clients attempting to contact the site. Since the infrastructure relies on Cloudflare, threat‑intel feeds that track Cloudflare‑hosted malicious domains should be consulted regularly for any related indicators. Continuous re‑evaluation is advised because the domain remains active and may evolve its tactics.