kra39cc[.]net

This domain, kra39cc.net, is identified as a credential theft operation targeting users of the KRA39 market platform. The page title, 'KRA39.cc - Вход в маркет,' directly mimics the legitimate login interface, suggesting an attempt to harvest user credentials through fraudulent authentication portals. No specific drainer kit signatures were observed, but the domain exhibits characteristics consistent with credential harvesting campaigns, including the use of Cloudflare for obfuscation and rapid deployment tactics. Analysis indicates the domain was registered on April 25, 2025, through NiceNIC International Group Co., Limited, and resolves to the IP address 104.21.82.70. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is protected by a Google Trust Services SSL certificate, leveraging HTTP/3 for encrypted communication. No detections were reported in Google Safe Browsing at the time of analysis, though this may reflect a lag in propagation. The domain has been taken offline, and PhishDestroy lists it as blocked. However, residual risk remains due to the potential reuse of infrastructure or registration of similar domains. Organizations should monitor for related indicators, including the IP 104.21.82.70 and the registrar NiceNIC, which may be leveraged in future campaigns. Users are advised to verify domain authenticity before entering credentials and to report any suspicious login pages resembling KRA39 market interfaces.