kra43[.]net

Analysis of kra43.net shows a recently created domain (registered on April 21, 2025) that is currently active and returns HTTP 200 responses. The site is hosted behind Cloudflare, using nameservers olga.ns.cloudflare.com and reese.ns.cloudflare.com, and resolves to the IP address 198.18.1.173. The TLS certificate is issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain, confirming the use of Cloudflare’s HTTPS termination. The page title observed in the HTTP response is "Игры, киберспорт и игровые новости kra43 cc — Рабочая Ссылка," which suggests the site is positioned as a gaming news portal, though no further page content has been examined. Technical fingerprints include Cloudflare Browser Insights and support for HTTP/3, indicating modern delivery infrastructure.

Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a security blocklist, with PhishDestroy explicitly blocking it. VirusTotal analysis recorded detections from three of ninety‑five scanning engines, reinforcing the suspicion of malicious activity. The registrar listed is NiceNIC International Group Co., Limited.

While the available data confirm hostile infrastructure and low trust metrics, the precise phishing payload or credential‑harvesting mechanisms have not been publicly disclosed, leaving the exact user‑facing tactics uncertain. Defenders should treat kra43.net as high‑risk. Recommended actions include adding the domain to DNS‑level blocklists, configuring web‑proxy or URL‑filtering solutions to deny traffic, and monitoring outbound connections to the resolved IP. Continuous threat‑intel feeds should be consulted for any emerging indicators of compromise related to this domain, and incident response teams should be prepared to investigate any internal logs that reference access attempts to kra43.net.