kra-35[.]net

PhishDestroy identifies kra-35.net as an active credential-harvesting domain designed to deceive users into surrendering login credentials. This domain does not impersonate a specific brand but functions as a generic phishing trap, likely deployed in mass campaigns to harvest account details across multiple services. The threat is classified as elevated due to its operational status and moderate detection rate among security vendors. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk domains, and resolves to IP address 104.21.36.201. Its SSL certificate, issued by Google Trust Services, adds a false veneer of legitimacy, further complicating user skepticism.

This domain was flagged by 8 out of 95 security vendors on VirusTotal, indicating a moderate but concerning detection rate. The domain was created on April 10, 2025, a relatively recent establishment that aligns with the active status of the phishing campaign. The presence of a Google Trust Services SSL certificate suggests an attempt to bypass browser-based security warnings, as some users may associate such certificates with trustworthy origins. Additionally, the domain’s association with NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar with a history of hosting malicious domains, raises further red flags. The combination of these technical indicators—low detection rate, recent creation, and registrar reputation—paints a picture of an opportunistic yet evolving threat.

As of the latest analysis, kra-35.net remains active, with no evidence of takedown or mitigation by hosting providers or registrars. Users are strongly advised to avoid interacting with this domain, as it poses a direct risk of credential theft. Security teams should block both the domain and its associated IP address (104.21.36.201) at the network level. While the current risk is elevated, the threat could escalate if the domain is weaponized against specific brands or sectors. Continuous monitoring is recommended, and users who may have already entered credentials should immediately change passwords and enable multi-factor authentication on their accounts. The remaining risk is moderate, contingent on the domain’s persistence and the effectiveness of ongoing security measures.