kra7[.]bond

The domain kra7.bond is currently classified as a high‑risk generic phishing site and remains active as of the report date, 25 July 2026. Registration data shows the domain was created on 23 February 2026 through NiceNIC International Group Co., Limited, and it is hosted behind Cloudflare’s network (AS13335). DNS resolution points to IP 172.67.149.70, which is located in the United States and is associated with Cloudflare, Inc. The domain uses Google Trust Services (certificate name WE1) for TLS, and the HTTP response is a 301 redirect, indicating the site forwards visitors to another location. The page title returned from the server is “Nur einen Moment…”, but no further content analysis is available.

Security telemetry indicates that two of ninety‑three VirusTotal scanners have flagged the domain, suggesting limited but non‑trivial detection by anti‑malware products. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service. A Gridinsoft trust score of 0 / 100 further reflects a lack of trustworthiness. Detected technologies include Cloudflare’s edge services and HTTP/3, confirming modern delivery infrastructure.

While the available evidence confirms malicious intent, the specific phishing payload or targeted brand has not been disclosed. Defenders should block the domain at network perimeter and DNS layers, monitor outbound connections to the associated IP, and ensure that any user‑facing filtering solutions (e.g., web proxies, secure web gateways) incorporate the known blocklist entry. Continuous re‑scanning on platforms such as VirusTotal is advised to capture any changes in vendor detections.