kra43-at[.]cc

The domain kra43-at.cc was registered on March 26 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.96.3, which is associated with a CDN provider and geolocated to Canada. The authoritative nameservers are arturo.ns.cloudflare.com and rosa.ns.cloudflare.com, confirming use of the provider’s DNS service. HTTP requests return a 301 redirect and the only observed page title is “Captcha”. The domain is listed on a single security blocklist and has been identified by a phishing‑related intelligence feed. Eight of ninety‑four scanners on a public malware analysis platform flag the domain as malicious, and an independent trust‑score service assigns it a score of 0 out of 100. The SSL certificate is issued by a well‑known certificate authority under the WE1 intermediate. The domain appears in one open‑source threat‑intel pulse. No further infrastructure such as additional IP addresses or hosting details is publicly disclosed. No detailed content analysis of the landing page is available, and the specific phishing campaign tactics, target audience, or credential‑harvesting mechanisms have not been observed. Because the domain is newly created, uses a CDN front‑end, and has multiple vendor detections, it should be considered high‑risk. Defensive operators are advised to block both the domain name and its resolved IP address at network perimeters, enforce TLS inspection for outbound HTTPS traffic, and monitor for any attempted connections. Continuous re‑scanning of the URL is recommended to detect potential changes in payload or hosting infrastructure.