kra27cc[.]net

This analysis documents the activity observed for the domain kra27cc.net, which was registered on 8 February 2025 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 198.18.1.230 and is served behind Cloudflare’s network, as indicated by the presence of Cloudflare nameservers (shaz.ns.cloudflare.com, yadiel.ns.cloudflare.com) and the detection of HTTP/3 support. An HTTPS certificate issued by Google Trust Services under the identifier WE1 is active, confirming that encrypted traffic is accepted. A simple HTTP request returns a 200 OK status and a page title that mirrors the domain name, suggesting that the site presents minimal content or a placeholder landing page.

Reputation signals are strongly negative. Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that 13 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of abusive use.

The lack of additional contextual data—such as a disclosed target brand, observed phishing pages, or sandboxed payloads—prevents precise classification of the phishing campaign’s objective. Given the combination of a recent registration, low‑reputation hosting, active SSL, and multiple vendor detections, defenders should treat kra27cc.net as a high‑risk indicator. Recommended mitigations include adding the domain and its resolved IP address to network‑level deny lists, updating DNS filtering policies, and monitoring for any outbound connections to the associated Cloudflare edge. Continuous re‑evaluation is advised, as future content analysis may reveal the specific credential‑harvesting technique or victim demographic employed by the actors behind this infrastructure.