kra-54-at[.]com

PhishDestroy identifies kra-54-at.com as a generic phishing domain that was designed to deceive users with a fraudulent captcha page. The domain is currently offline, having been taken down after its malicious activity was detected. The threat type is generic phishing, meaning it did not impersonate a specific well-known brand but rather used a common social engineering technique to trick visitors into performing actions that compromise their security.

Technical analysis reveals that the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and was created on May 7, 2026. It resolved to IP address 172.67.204.95 and used an SSL certificate issued by Google Trust Services (WE1). VirusTotal flagged it with 1 detection out of 95 security vendors, and it appeared on 1 security blocklist. AlienVault OTX also included it in 1 threat intelligence pulse. The page title was simply "Captcha," indicating a likely fake verification step to harvest credentials or deploy malware.

Given that the domain is now offline, the immediate risk is mitigated. However, users who may have interacted with the site should change passwords and monitor for suspicious activity. PhishDestroy recommends avoiding any domains that prompt for unexpected captchas or personal information, and always verifying URLs before entering sensitive data. Continued vigilance is advised as similar domains may reappear under different names.