at-kra53[.]cc

This domain is flagged for credential phishing activity targeting users through a deceptive Captcha-themed interface. Analysis indicates the domain is designed to mimic legitimate authentication challenges, tricking victims into submitting sensitive login credentials or personal information. The threat type is classified as generic_phishing with an elevated risk level due to its active exploitation potential and detection by multiple security mechanisms. Infrastructure analysis reveals the domain at-kra53.cc was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.205.220, hosted on Cloudflare infrastructure in Canada. The domain appears on one security blocklist and is flagged by 11 out of 95 security vendors on VirusTotal. Its SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious domains leveraging Cloudflare’s proxy services. The page title, 'Captcha,' aligns with the phishing tactic of impersonating verification prompts to lower user suspicion. Mitigation steps for this threat include immediate blocking of the domain and its associated IP (172.67.205.220) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) to endpoint detection systems to prevent access attempts. User awareness training should emphasize the risks of entering credentials on Captcha-like pages, particularly those hosted on newly registered or unfamiliar domains. Monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to Cloudflare IPs may help identify related phishing campaigns. Given the domain’s current offline status, continuous monitoring for reactivation or domain reuse is recommended.