kra-5at[.]com

This domain is flagged as a high-risk fake login portal designed to harvest credentials through deceptive login interfaces. Analysis indicates the infrastructure is specifically crafted to mimic legitimate authentication pages, likely targeting users of cryptocurrency platforms or financial services. The domain exhibits multiple technical indicators of malicious intent, including the absence of an SSL certificate and a short operational window before being taken offline. Infrastructure analysis reveals the domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 95.85.236.107, hosted by MHost LLC in Germany, a provider with a history of hosting phishing infrastructure. The domain is flagged by 17 out of 95 security vendors on VirusTotal, appears on two security blocklists, and is explicitly labeled as phishing by Google Safe Browsing. Additionally, it has been blocked by multiple threat intelligence feeds, including PhishDestroy and PhishingDB, further corroborating its malicious classification. To mitigate risks associated with this fake login portal, organizations and users should immediately block the domain and its resolving IP address at the network perimeter. Security teams are advised to scan for any historical DNS resolutions or connections to 95.85.236.107 and kra-5at.com within their logs. End-users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly those related to financial or cryptocurrency services. Enabling multi-factor authentication (MFA) on all critical accounts provides an additional layer of protection against credential harvesting. Given the domain's current offline status, monitoring for re-registration or similar domains using the same registrar or hosting provider is recommended.