Analysis of the domain krekansofa.com indicates it is an active phishing infrastructure as of July 31, 2026. The domain was registered on July 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It currently resolves to the IP address 188.114.97.3, which is part of Cloudflare's network, a common hosting choice for phishing sites due to its proxy services and ease of setup. The domain uses Cloudflare nameservers (julio.ns.cloudflare.com and tegan.ns.cloudflare.com), further aligning with observed patterns in phishing infrastructure. Security vendor assessments provide limited but notable signals.
Gridinsoft has assigned a trust score of 0/100, reflecting high-risk characteristics. The domain appears on one security blocklist, specifically PhishDestroy, though broader industry detection remains limited. As of the latest scan, 91 vendors on VirusTotal have evaluated the domain, with none currently flagging it as malicious. However, the absence of detections does not confirm safety, particularly given the domain's recent registration and active status.
The exact nature of the phishing content hosted on krekansofa.com is not yet analysed, as no page title, brand target, or scam type has been confirmed. Defenders should treat this domain as a potential threat and monitor for further indicators of compromise. Network-level blocking is recommended, particularly for organisations with exposure to credential theft or financial fraud risks. Continuous monitoring of associated infrastructure, including the IP address and registrar, is advised to track potential pivot points or additional malicious domains.