kr-9[.]cc

The domain kr-9.cc, once active, is now offline. Despite its current status, it has been flagged by 9 out of 94 vendors on VirusTotal as malicious. The domain, registered with NICENIC INTERNATIONAL GROUP CO., LIMITED, was hosted on an IP associated with Cloudflare in Canada. PhishDestroy added kr-9.cc to its public blocklist, marking it as a generic phishing threat.

The SSL certificate for kr-9.cc was issued by Google Trust Services, suggesting an attempt to appear legitimate. The domain's platform risk score is 63 out of 100, indicating a moderate level of threat. This score reflects the potential harm the domain could cause if it were still active. The quick detection by PhishDestroy, just a day after its creation, highlights the effectiveness of upstream threat intelligence in identifying risks before they propagate widely.

Although kr-9.cc is currently offline, the initial detection and subsequent flagging underscore the importance of early intervention in cybersecurity. The domain's association with Cloudflare, a reputable hosting provider, and the use of a Google-issued SSL certificate, demonstrate the sophisticated tactics employed by threat actors to deceive users. Monitoring and rapid response remain crucial in mitigating the impact of such phishing operations.