kra-b23[.]cc

This domain is identified as a credential harvesting page designed to mimic legitimate Captcha verification processes. Analysis indicates the site presents a fake login or authentication prompt, tricking users into submitting sensitive credentials such as usernames, passwords, or multi-factor authentication codes. The goal is to capture and exfiltrate these credentials for unauthorized access to user accounts or financial information. Infrastructure analysis reveals the domain kra-b23.cc was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.130.79, hosted behind Cloudflare infrastructure in Canada. The domain is flagged by 9 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services, specifically the WE1 intermediate, which is commonly used by legitimate and malicious sites alike. Users who visited kra-b23.cc should immediately revoke any entered credentials by changing passwords for affected accounts. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unfamiliar transactions or login attempts. If financial or sensitive personal information was submitted, consider reporting the incident to relevant authorities and credit monitoring services. Clear browser cache and cookies to remove any residual tracking elements, and verify that no unauthorized browser extensions or malware were installed during the visit.