kra-35-at[.]com

PhishDestroy identifies kra-35-at.com as an active credential harvesting scam domain designed to collect sensitive user information, such as login credentials. There is no direct association with a known brand or drainer kit at this time, but its intent aligns with typical generic phishing campaigns targeting unsuspecting users with deceptive tactics.

Technical indicators reveal kra-35-at.com was registered recently on February 8, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 188.114.97.3 and employs a Google Trust Services SSL certificate, potentially to masquerade as a legitimate site. VirusTotal flags this domain as malicious by 3 out of 95 security vendors, indicating emerging but limited detection. The domain is currently active and not yet widely blacklisted, although Google Safe Browsing status is implied as risky.

Currently, kra-35-at.com is an elevated risk phishing threat with active exploitation potential. Users and organizations should exercise caution and avoid interacting with suspicious links related to this domain. Security teams are advised to monitor for new detections, block the IP and domain at perimeter defenses, and educate end-users about credential harvesting risks. Immediate proactive blocking and reporting remain critical to mitigate ongoing risks posed by this emerging scam site.