kra52-at[.]cc

The domain kra52-at.cc is confirmed to be a generic phishing site, specifically designed to impersonate a legitimate login page. While no specific brand impersonation or drainer kit is identified, the domain's infrastructure and behavior indicate a high risk of credential theft.

Infrastructure analysis reveals that kra52-at.cc has been flagged by 13 out of 95 security vendors on VirusTotal, suggesting a moderate level of malicious activity. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.161.105, which is located in CA and associated with Cloudflare, Inc. The domain was created on March 26, 2026, and currently appears on 1 security blocklist. The SSL certificate is issued by Google Trust Services / WE1, which may be used to instill a false sense of security in potential victims.

The domain is currently offline, which may indicate that it has been taken down by the registrar or hosting provider in response to security reports. Despite its offline status, the risk remains elevated due to the potential for the domain to be reactivated. Users are advised to avoid interacting with this domain and to report any future sightings to their security teams or relevant authorities. Additional monitoring and blocking measures should be implemented to prevent any further phishing attempts.