xn--krken28-bn4c[.]com

PhishDestroy identifies krken28-bn4c.com as an active phishing domain mimicking legitimate login portals, posing an elevated risk to users. This domain was flagged by 5 out of 95 VirusTotal security vendors, indicating partial detection by mainstream antivirus engines. It was registered on April 07, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted at IP 188.114.97.3. The domain appears on 1 public blocklist and uses a Let’s Encrypt SSL certificate, which may lend it an air of legitimacy. Such combinations of recent registration, partial vendor detection, and hosting infrastructure are common in short-lived credential harvesting campaigns designed to evade immediate blacklisting.

Technical indicators reinforce the elevated risk profile. The domain resolves to a single IP address shared among multiple high-risk sites, suggesting a bulletproof hosting arrangement typical of phishing operations. Let’s Encrypt certificates are frequently abused due to their automated issuance process, allowing threat actors to rapidly deploy HTTPS infrastructure for deception. The low blocklist coverage—just one entry—implies the domain may still be in early propagation stages, spreading via phishing emails, social media, or impersonation attacks before widespread awareness emerges.

Mitigation for this threat type requires immediate action at both network and user levels. Organizations should block traffic to 188.114.97.3 and the domain krken28-bn4c.com at the firewall or DNS resolver. Users who have entered credentials should assume compromise and rotate passwords across critical accounts, enabling multi-factor authentication where available. Security teams should also scan endpoints for suspicious login patterns or data exfiltration attempts. Because this domain continues to evade full detection despite partial flags, early identification via threat intelligence feeds like PhishDestroy can prevent large-scale credential theft.