kra30-at-cc[.]com

The domain kra30-at-cc.com has been identified as a phishing site specifically targeting MetaMask users. Although the site is currently offline, it has already been flagged by 16 out of 94 vendors on VirusTotal, indicating a significant level of malicious activity. This domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted on IP address 185.226.92.168 in Turkey, under the organization BIGCORE.

The domain's SSL certificate was issued by Let's Encrypt, a common choice for phishing sites due to its free and automated nature. Despite the site's offline status, it has been included in three public blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. The relatively high abuse score of 46 out of 100 further underscores the threat level this domain posed during its active period.

Phishing domains like kra30-at-cc.com exploit the trust users place in brands like MetaMask, aiming to steal sensitive information such as login credentials and private keys. The proactive inclusion of this domain in blocklists and its detection by multiple security vendors highlight the importance of rapid response in the cybersecurity landscape. Although it is no longer active, the swift takedown of kra30-at-cc.com serves as a reminder of the ongoing battle against phishing threats.