kra39web[.]cc

Analysis as of July 24 2026 indicates that the domain kra39web.cc is offline but was previously identified as a phishing infrastructure. The domain was registered on February 21 2026 and resolves to the IP address 172.67.170.146, which belongs to AS13335 operated by Cloudflare, Inc. The hosting location is the United States. The TLS certificate presented by the site is identified as “WE1”. VirusTotal scans show that four out of ninety‑three security vendors flagged the domain as malicious, providing independent corroboration of its suspicious nature.

The domain appears on a single blocklist, specifically PhishDestroy, confirming that at least one external mitigation service has taken action to block it. The HTTP response returned a page title of “kra46.cc”, which does not match the registered domain and is a typical indicator of a mismatched or spoofed landing page. No additional intelligence such as Safe Browsing, OTX, or registrar reputation is available in the current dataset. Because the site is currently taken offline, immediate traffic to the IP address is unlikely, but the underlying hosting provider (Cloudflare) may be reused for future malicious campaigns.

Defenders should continue to monitor the IP 172.67.170.146 for any re‑appearance of malicious content, enforce blocklist entries that reference kra39web.cc, and consider adding the domain to internal deny lists. Network sensors should be configured to alert on DNS queries for kra39web.cc and any rapid resolution changes. Given the limited blocklist coverage (one list) and the modest detection count, further verification through dynamic analysis or sandboxing is recommended if the domain becomes active again. Maintaining up‑to‑date threat intel feeds that include Cloudflare‑hosted malicious actors will reduce exposure to repeat use of this infrastructure.