kra16c[.]cc

PhishDestroy identifies kra16c.cc as an active credential harvesting phishing domain under investigation. The domain was registered on April 04, 2025 and resolves to IP 172.67.134.22. It leverages a Google Trust Services SSL certificate to appear legitimate while targeting user credentials. Current VirusTotal analysis shows 1/95 detections, indicating evasion of common blocklists. This domain was flagged through NICENIC INTERNATIONAL GROUP CO., LIMITED with no prior detections on VirusTotal and no presence on public threat intelligence feeds as of investigation time. The SSL certificate issued by Google Trust Services adds a false layer of legitimacy, increasing the likelihood of successful deception. The domain’s recent creation (April 04, 2025) and clean reputation suggest an opportunistic campaign likely exploiting newly registered infrastructure. Mitigation requires immediate blocking of kra16c.cc and 172.67.134.22 at network and endpoint levels. Users should avoid accessing the domain and verify any unexpected login prompts via official channels. Security teams are advised to inspect DNS logs for resolution attempts and update email filtering rules to block messages referencing this domain. Given the absence of detections, heuristic analysis and behavioral monitoring are critical to preempt further compromise.