kra33---cc---at[.]sbs

The domain kra33---cc---at.sbs is currently identified as a generic_phishing threat specializing in credential theft and fraudulent activity. Analysis confirms the domain is offline, though prior infrastructure remains a documented risk. No direct brand impersonation has been established, but the domain’s characteristics align with large-scale phishing operations targeting login credentials and sensitive user data. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026, an atypical future-dated registration that deviates from standard domain lifecycle patterns. It resolves to the IP address 193.105.134.22, hosted under w1n ltd in Sweden, and presents a default nginx welcome page, a common indicator of hastily deployed or abandoned phishing infrastructure. Security vendors on VirusTotal flagged the domain in 10 of 95 detections, while it appears on one active security blocklist. The SSL certificate, issued to Internet Widgits Pty Ltd, lacks organizational validation and further reduces trustworthiness. As the domain is currently offline, immediate interaction risks are mitigated. However, historical indicators and infrastructure artifacts remain concerning. Organizations and users are advised to block the domain and its associated IP at the network level, monitor for re-registration under similar naming conventions, and enforce multi-factor authentication to mitigate credential-based attacks. Security teams should review logs for prior connections to 193.105.134.22 and assess potential exposure.