jkra33[.]cc

Analysis indicates that the domain jkra33.cc is currently active and flagged as a high-risk phishing redirect site. Registered on March 28, 2026, through NameSilo, LLC, the domain resolves to the IP address 172.237.129.242, hosted by a provider in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (ariadne.ns.cloudflare.com and tom.ns.cloudflare.com) and an SSL certificate issued by Let's Encrypt. The domain returns an HTTP 200 status with a page title of 'Redirecting...', suggesting it functions as an intermediary in phishing campaigns rather than hosting final payloads. Defenders should note that jkra33.cc appears on at least one security blocklist (PhishDestroy) and is referenced in 22 threat intelligence pulses on AlienVault OTX, indicating prior detection in malicious activity. While only two of 94 security vendors on VirusTotal currently flag this domain, the discrepancy between vendor detections and other threat intelligence sources suggests either evolving detection coverage or targeted evasion techniques. The Gridinsoft trust score of 0/100 further supports its classification as malicious. The exact content or target of the phishing campaign remains unconfirmed, as no specific brand or scam type is identified in available data. The domain's recent registration (under four months old) aligns with common phishing infrastructure patterns, where newly created domains are frequently used to evade reputation-based filters. Network defenders are advised to block the domain and its resolving IP at perimeter controls, monitor for internal connections to 172.237.129.242, and investigate any user interactions with jkra33.cc for potential credential exposure or malware delivery.