kra-31[.]cc

This domain, kra-31.cc, has been identified as a fake login portal designed to harvest user credentials. Analysis indicates the domain is currently offline, though it previously hosted a phishing page mimicking a legitimate authentication interface. No specific brand impersonation has been confirmed, but the generic phishing infrastructure aligns with credential theft campaigns targeting unsuspecting users. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 28, 2026, an unusually future-dated registration likely indicative of fraudulent activity. It resolves to the IP address 95.85.236.107, hosted by MHost LLC in Germany. The domain appears on one security blocklist and has been flagged by 13 of 95 security vendors on VirusTotal. No SSL certificate was detected, further reducing its legitimacy. The domain's creation date and lack of encryption are consistent with short-lived phishing operations. Current status confirms kra-31.cc has been taken offline, though residual risks may persist if cached or archived versions remain accessible. Organizations are advised to block the domain and its associated IP (95.85.236.107) at the firewall or DNS level. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window. Security teams should monitor for related indicators, including the registrar NICENIC INTERNATIONAL GROUP, as part of broader threat hunting efforts.