www-kra-34[.]cc

www-kra-34.cc has been confirmed to host a live crypto credential theft scam campaign. As of today this domain remains active and is actively luring victims into surrendering cryptocurrency account details through spoofed login interfaces. Operators are rotating infrastructure rapidly, evidenced by the June 30, 2025 registration date and the use of a Google-issued SSL certificate to establish fraudulent legitimacy. This domain was flagged by 7 of 95 VirusTotal vendors within hours of becoming resolvable, indicating high confidence in its malicious intent. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolving to IP address 172.67.194.26. Google Trust Services issued the SSL certificate on creation day, suggesting the threat actor is attempting to bypass browser warnings via a trusted CA. The short operational window and low VT detection ratio at time of discovery underscore the need for rapid containment before broader compromise occurs. Current status remains active at the time of analysis. Immediate defensive actions include: 1) adding www-kra-34.cc and 172.67.194.26 to blocklists at DNS, firewall, and proxy layers; 2) disabling outbound HTTPS connections to the IP via DLP policies; 3) reviewing logs for historical hits pointing to this domain or IP; 4) alerting SOC teams to flag any additional domains registered by NICENIC INTERNATIONAL GROUP CO., LIMITED within the last 72 hours. Monitor for re-registration after takedown attempts.