kra8[.]me

The domain kra8.me was registered on 21 February 2026. DNS resolution points exclusively to the IP address 172.67.175.61, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The web server presented a single HTML document whose title is “Captcha”, suggesting the site may be used to present a captcha challenge before forwarding victims to a credential‑harvesting page, a tactic commonly observed in generic phishing campaigns. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence that the domain is malicious.

The domain appears on one known security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal analysis shows that 1 of 93 scanning engines flagged the domain, confirming at least one independent detection. The site used an SSL certificate labeled “WE1”, which provides no public‑trusted CA information and is consistent with fast‑issued certificates often used by malicious operators. As of the report date, the site is taken offline, and no further HTTP response data are available.

The available evidence confirms that kra8.me is part of a phishing infrastructure, but the specific target brand, credential‑stealing mechanism, and any associated command‑and‑control infrastructure remain unknown. Defenders should continue to block the domain at perimeter filters, update URL filtering lists with the observed IP address, and monitor for any resurrection of the domain or reuse of the same Cloudflare edge. Incident response teams should also consider correlating any recent user‑initiated connections to 172.67.175.61 with credential‑theft alerts, and apply the same blocklist rules to similar domains that resolve to the same ASN. Ongoing intelligence collection is advised to capture any future changes in the domain’s hosting or SSL configuration.