kra--55[.]cc

This domain, kra--55.cc, is actively serving a credential-harvesting phishing page as of July 12, 2026. Analysis indicates the site presents a deceptive 'Captcha' page, a common tactic to trick users into entering sensitive information. The domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 188.114.97.3, hosted by CloudFlare, Inc. in Canada. The infrastructure is protected by Cloudflare nameservers (eleanor.ns.cloudflare.com and scott.ns.cloudflare.com), which may obscure further investigation into the origin or backend systems. Security vendors have flagged this domain with a detection ratio of 7 out of 95 on VirusTotal, and it appears on at least one security blocklist, specifically PhishDestroy. Additionally, the domain is referenced in eight threat intelligence pulses on AlienVault OTX, suggesting broader recognition within the security community. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious nature of the site, as phishing domains frequently leverage legitimate certificates to appear trustworthy. The HTTP 301 redirect status suggests the domain may be part of a larger redirection chain, potentially funneling victims to additional malicious endpoints. While the exact phishing kit or targeted brand remains unconfirmed, the use of a 'Captcha' page aligns with known credential-harvesting campaigns. Defenders should treat this domain as high-risk and implement blocking measures at both the DNS and network levels. Monitoring for related infrastructure, such as connected IP addresses or newly registered domains under the same registrar, is recommended to identify potential lateral movement or secondary attack vectors.