kra45-cc[.]net

Analysis as of July 24 2026 identifies kra45-cc.net as an active generic phishing infrastructure. The domain was registered on August 21 2025 through NiceNIC International Group Co., Limited and continues to resolve to the IPv4 address 198.18.1.62. DNS resolution is delegated to the Cloudflare nameservers arturo.ns.cloudflare.com and rosa.ns.cloudflare.com, indicating that the site is fronted by Cloudflare’s edge network. Network observations show the site serving HTTP over TLS with a Google Trust Services / WE1 certificate, supporting HTTP/3 and Cloudflare Browser Insights. An HTTP GET returns status code 200 and the only observable page title is “Captcha”, suggesting a possible challenge mechanism but providing no further insight into the payload or target brand.

Reputation services flag the domain with a Gridinsoft trust score of 0 out of 100 and it appears on one external security blocklist. VirusTotal scans report four detections out of ninety‑five scanners, confirming that multiple vendors have identified malicious behavior. The domain is also listed as blocked by PhishDestroy. No additional intelligence such as OTX references, Safe Browsing alerts, or detailed payload samples is presently available.

Given the confirmed phishing classification, the observed infrastructure and the modest but consistent detection footprint, defenders should prioritize immediate containment. Recommended actions include adding kra45-cc.net to DNS and proxy blocklists, monitoring for DNS queries to the associated IP address, and enabling Cloudflare’s threat intelligence feeds where possible. Continuous re‑scanning of the domain with sandbox and URL‑analysis tools is advised to capture any evolving payloads. Organizations should also consider alerting end‑users about the presence of a generic phishing site that may use a CAPTCHA page to obscure its intent.