at-kra39[.]cc

This domain, at-kra39.cc, is flagged as an elevated-risk credential theft operation designed to harvest user login credentials through deceptive login portals. Analysis indicates the infrastructure is tailored to mimic legitimate authentication pages, tricking victims into submitting sensitive account information such as usernames, passwords, and multi-factor authentication codes. The threat type is highly targeted, with a focus on financial, corporate, or personal accounts, and poses significant risks of unauthorized access and identity theft. Infrastructure analysis reveals the domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 95.85.236.107, hosted by MHost LLC in Germany, a provider with a history of hosting phishing infrastructure. The domain appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. No SSL certificate was detected, further reducing the domain's legitimacy and increasing the likelihood of interception during credential transmission. To mitigate risks associated with this credential theft campaign, organizations and individuals should immediately block the domain at-kra39.cc and its resolving IP 95.85.236.107 at the network level. Endpoint protection solutions should be updated to include this domain in deny lists, and users should be educated on identifying fake login portals, such as checking for HTTPS, verifying domain names for typos, and avoiding unsolicited authentication requests. Multi-factor authentication (MFA) should be enforced for all critical accounts to limit the impact of stolen credentials. Security teams are advised to monitor for signs of compromised accounts and reset credentials for any users who may have interacted with the domain.