kra34cc[.]vip

PhishDestroy identifies kra34cc.vip as an active credential harvesting domain posing an elevated risk to visitors. This recently created domain operates as a generic phishing site, likely designed to impersonate legitimate services and trick users into submitting login credentials. Security researchers and end-users should treat this domain with high caution, as it exhibits multiple red flags consistent with malicious activity targeting unsuspecting victims. This domain was flagged by 3 out of 95 VirusTotal security vendors, indicating limited but notable detection of its malicious nature. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting dynamic and often abusive registrations. kra34cc.vip resolves to IP address 104.21.48.157, a hosting provider frequently associated with phishing campaigns. The domain was created on June 03, 2025, making it extremely new and untrusted. Despite a valid SSL certificate issued by Google Trust Services—commonly abused by threat actors to appear legitimate—there are no indicators of legitimate use. This domain remains unlisted on major threat intelligence blocklists as of the latest scan, suggesting rapid deployment and currently low exposure in global defenses. Users who encounter kra34cc.vip should immediately refrain from interacting with the site, especially avoid entering any login credentials, personal information, or payment details. Given the domain’s recent registration and low but critical detection rate, it is likely targeting unsuspecting users with fake login portals. To verify site safety and confirm this domain’s malicious status, users should consult PhishDestroy’s threat lookup tool before proceeding. Organizations are advised to block access to 104.21.48.157 at the network level and update firewall rules to prevent outbound connections. Always report suspicious domains to threat intelligence platforms to enhance collective defense against credential harvesting campaigns.