krak2[.]net

This domain is classified under an elevated risk level due to its association with generic_phishing activity. Analysis indicates it was designed to harvest user credentials or distribute fraudulent content, leveraging deceptive infrastructure to mimic legitimate services. The domain exhibits characteristics consistent with phishing campaigns, including short-term registration and low-reputation hosting providers. Infrastructure analysis reveals the following technical indicators: the domain krak2.net was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 95.85.236.107, hosted by MHost LLC in Germany. At the time of assessment, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by VK / VK interm CA, a non-standard certificate authority often associated with low-trust environments. The domain has since been taken offline, but historical activity suggests prior malicious use. To mitigate risks associated with this phishing domain, organizations should implement the following measures: block the domain and its resolving IP (95.85.236.107) at the network perimeter using firewalls or DNS filtering. Update endpoint protection rules to include the domain and its associated indicators of compromise (IOCs). Conduct retrospective log analysis to identify any prior connections to krak2.net within the past 90 days, focusing on authentication logs and web proxy data. Educate users on recognizing phishing attempts, particularly those involving credential harvesting or fake login portals. Monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or hosted on MHost LLC infrastructure, as these may indicate related threat actor activity.