kra29c[.]cc

This domain is flagged as a credential harvesting phishing site, targeting user login credentials through deceptive login portals. The risk level is classified as elevated due to confirmed malicious activity and detection by multiple security mechanisms. Analysis indicates the domain is designed to mimic legitimate authentication pages, likely for financial or corporate account compromise. Infrastructure analysis reveals the domain kra29c.cc was registered on March 29, 2026, through Gname 123 Inc, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.202.77, hosted by Cloudflare, Inc. in Canada, a common proxy service used to obscure malicious infrastructure. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Let's Encrypt (serial E8), providing encrypted connections to enhance deception. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, with behavioral and signature-based detections confirming phishing intent. The domain is currently offline, though historical activity suggests potential for reactivation under similar infrastructure. Mitigation requires immediate action from network security teams. Block the domain kra29c.cc and its resolving IP 172.67.202.77 at perimeter defenses, including firewalls, DNS filters, and email gateways. Monitor for certificate reuse (Let's Encrypt E8) across other domains, as attackers frequently rotate infrastructure while retaining SSL chains. Endpoint protection should be updated to include the domain and IP in threat intelligence feeds. Security awareness training should emphasize the risks of credential harvesting, particularly for users accessing login portals from unsolicited links. If the domain reactivates, conduct a forensic review of any user interactions to assess potential credential exposure or account compromise.