kra301[.]cc

This domain, kra301.cc, is actively flagged as a high-risk phishing infrastructure targeting users associated with the page title 'krab3.cc'. Registered on April 10, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to IP address 172.67.166.46 and employs Cloudflare services, including Cloudflare Browser Insights and HTTP/3, likely to obfuscate its origin and evade detection. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy due to its widespread use across both malicious and benign domains. Analysis indicates the domain has been identified in 22 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, specifically PhishDestroy and BLP-Malware. While 15 of 95 security vendors on VirusTotal flag the domain as malicious, this detection rate suggests moderate but not universal recognition of its threat status. The Gridinsoft trust score of 0/100 further corroborates its classification as malicious infrastructure. The exact nature of the phishing content remains unconfirmed, as the page title 'krab3.cc' does not correspond to a known brand or service. Defenders should treat this domain as an active threat, blocking resolution at the DNS level and monitoring for connections to the IP address 172.67.166.46. Given the use of Cloudflare, additional scrutiny of related domains or IPs within the same infrastructure may be warranted to identify linked malicious activity. No evidence currently links this domain to a specific phishing kit or broader campaign, but its persistence and detection across multiple threat feeds justify immediate defensive action.