kpa36[.]cc

This domain, kpa36.cc, is identified as a high-risk phishing resource targeting users of the KRA36 platform. Analysis of the page title, "Вход в kra36 через kra36.cc," confirms it impersonates the legitimate KRA36 login portal, likely designed to harvest user credentials or facilitate unauthorized account access. No explicit drainer kit signatures were detected, but the domain exhibits characteristics consistent with credential phishing infrastructure, including the use of Cloudflare to obfuscate hosting origins and evade detection. Infrastructure analysis reveals the domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 104.21.62.8, which is part of a content delivery network known for hosting both legitimate and malicious content. The domain is flagged by 12 out of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0/100. It appears on three security blocklists, including MetaMask and PhishDestroy, and employs a Google Trust Services SSL certificate to lend an appearance of legitimacy. Detection rates and blocklist inclusion indicate a coordinated effort to mitigate its impact. As of the latest assessment, kpa36.cc has been taken offline, reducing immediate exposure risks. However, the domain's infrastructure remains registered, and similar campaigns may re-emerge under new domains or IPs. Users who interacted with the site are advised to rotate credentials, monitor for unauthorized transactions, and verify account activity. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate potential lateral movement or follow-on attacks stemming from compromised credentials.