kra-43-at[.]com

This domain, kra-43-at.com, is flagged as an active credential phishing site leveraging a CAPTCHA-themed page to deceive users. Registered on May 7, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains operational despite being blocked by at least one security vendor and appearing on a security blocklist. Infrastructure analysis reveals the domain is proxied behind Cloudflare, with nameservers arturo.ns.cloudflare.com and rosa.ns.cloudflare.com, and resolves to the IP address 104.21.26.190, located in Canada. The use of Cloudflare is consistent with threat actor tactics to obscure hosting origins and evade takedown efforts. The page title 'Captcha' suggests an attempt to mimic legitimate security verification processes, a common technique to lower user suspicion while harvesting credentials. The domain has been detected by 3 out of 95 security vendors on VirusTotal, indicating moderate but not universal recognition of its malicious nature. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy, though this is a routine practice among phishing operators to avoid browser warnings. The HTTP 301 redirect status may indicate further redirection to a final phishing page, though the destination remains unconfirmed. Defenders should prioritize blocking this domain at the network level, particularly given its persistence despite existing detections. The combination of a recent registration date, Cloudflare proxying, and a CAPTCHA-themed lure aligns with known phishing infrastructure patterns. While the exact target or brand impersonated is not specified in available intelligence, the domain’s structure and behavior are consistent with credential harvesting campaigns. Monitoring for related domains using similar naming conventions or infrastructure may help preempt further attacks. Given the domain’s continued activity, immediate action is recommended to mitigate potential exposure.