kra-44-at[.]com

Analysis of the domain kra-44-at.com indicates it is an active phishing site operating under the guise of a Captcha verification page. Registered on August 21, 2025, through NiceNIC International Group Co., Limited, the domain resolves to the IP address 198.18.1.46 and is currently returning an HTTP 200 status, suggesting the site is operational. Infrastructure analysis reveals the use of Cloudflare nameservers (arturo.ns.cloudflare.com and rosa.ns.cloudflare.com), alongside Cloudflare Browser Insights and HTTP/3 technologies, which may be employed to obfuscate the true origin of the malicious traffic or evade detection. The domain appears on at least one security blocklist, and three of 95 security vendors on VirusTotal have flagged it as malicious.

The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which is commonly exploited by threat actors to lend an appearance of authenticity to phishing domains. The Gridinsoft trust score for this domain is 0 out of 100, further supporting its classification as high-risk. The site has been specifically blocked by PhishDestroy, a dedicated anti-phishing service. While the page title 'Captcha' suggests an attempt to mimic a verification process, the exact nature of the phishing scheme—such as whether it targets credentials, personal data, or financial information—remains unconfirmed due to the lack of deeper content analysis.

The domain's registration through a privacy-focused registrar and its use of Cloudflare infrastructure are consistent with tactics observed in other phishing campaigns aimed at prolonging operational uptime. Defenders are advised to treat this domain as malicious and implement blocking measures at the network and endpoint levels. Organizations should monitor for connections to 198.18.1.46 and the domain kra-44-at.com in logs, and consider adding it to internal threat intelligence feeds.