kra48att[.]cc

PhishDestroy identifies kra48att.cc as an active credential theft domain operating under a generic phishing campaign. The domain was registered on November 19, 2025, and remains unblocked by most defenses despite clear malicious indicators. Current status is classified as elevated risk, with threat actors leveraging the domain to harvest login credentials under false pretenses. The domain resolves to IP address 185.226.92.168 and was created on November 19, 2025. Security telemetry confirms kra48att.cc has been flagged by 10 of 95 VirusTotal vendors, with additional risk factors including a Let's Encrypt SSL certificate issued for increased deception. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in phishing infrastructure due to lax oversight. While specific blocklist counts are not publicly disclosed, the combination of low trust scores and high VT detection rate underscores the domain’s hostile nature. Users and organizations are strongly advised to block kra48att.cc at the DNS and firewall levels. Network defenders should inspect outbound traffic for connections to 185.226.92.168 and audit logs for any interactions with the domain. End users must be warned against entering credentials or sensitive information into any page hosted on kra48att.cc. Immediate remediation includes updating blocklists, reviewing SIEM alerts for related hashes or IPs, and conducting phishing awareness training to prevent account compromise.