# nk9956.craftum.io — MALICIOUS

> nk9956.craftum.io is an active high-risk phishing domain. Stay alert and avoid interactions. Learn how to protect yourself from this threat.

## Summary
PhishDestroy identifies nk9956.craftum.io as an active phishing domain posing a high risk to users. This threat attempts to deceive individuals into divulging sensitive information, which could lead to data theft or financial loss. Recognizing such domains early is critical to preventing compromise.

The domain nk9956.craftum.io was registered on April 7, 2021, through the Regional Network Information Center, JSC dba RU-CENTER. It currently resolves to IP address 92.255.111.71. VirusTotal flags this domain with 17 out of 95 security vendors detecting malicious activity, underscoring its credibility as a phishing threat.

Users are strongly advised to avoid clicking links or submitting personal information on nk9956.craftum.io. Always verify the legitimacy of unexpected emails or messages directing you to unfamiliar websites. Employ updated security tools and report suspicious activity to maintain protection against evolving phishing campaigns.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP 200)
- Page title: SFR Mail – Retrouvez votre Webmail, boite mail et adresse mail

## Domain Intelligence
- Registered: 2026-03-08 13:07:01
- Registrar: Regional Network Information Center, JSC dba RU-CENTER
- IP: 92.255.111.71
- Nameservers: ns1.craftum.io ns1.craftum.io 176.57.223.234 ns2.craftum.io ns2.craftum.io 176.57.223.235

## Detection Status
- VirusTotal: 18 vendors flagged
  Vendors: ["ADMINUSLabs", "CRDF", "Cluster25", "CyRadar", "DNS8", "ESET", "Emsisoft", "Forcepoint ThreatSeeker", "Fortinet", "Gridinsoft", "Kaspersky", "Lionic", "MalwareURL", "Netcraft", "Sophos", "Trustwave", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Live Page Content

### Page Text
SFR Mail – Retrouvez votre Webmail, boite mail et adresse mail Войти Создать сайт Сайт временно недоступен Скорее всего, закончилась подписка. Если это ваш сайт, войдите в панель
                управления
                Craftum и продлите подписку.

### External Links
- https://craftum.com
- https://craftum.com/login/
- https://craftum.com/registration/

## Evidence
- Screenshot: https://i.ibb.co/rKm1hD6k/f9b2d86164c1.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/2abd6dc8-4e1f-4124-81b7-15ddf97ede74
- PhishDestroy: https://phishdestroy.io/domain/nk9956.craftum.io/

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/nk9956.craftum.io/
Last updated: 2026-03-14