kra33c[.]com

This domain, kra33c.com, is flagged as an elevated-risk credential harvesting site targeting users through a fake login portal. Analysis indicates the threat type is generic_phishing, specifically designed to mimic legitimate authentication pages to capture sensitive credentials. The page title, 'KRA33 — Войти на официальный сайт,' suggests a focus on Russian-speaking users, likely impersonating a trusted platform to deceive victims into submitting login details. Infrastructure analysis reveals the domain resolves to IP address 104.21.34.12, hosted behind Cloudflare in Canada. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend superficial legitimacy. Despite its current offline status, historical activity confirms its use in phishing campaigns. Mitigation requires immediate action to prevent credential theft. Network administrators should block the domain and its associated IP (104.21.34.12) at the firewall or DNS level. Endpoint protection solutions should be updated to include this domain in denylists, and users should be educated on recognizing fake login pages, particularly those using Cyrillic characters or mimicking regional services. Organizations should also monitor for compromised credentials linked to this domain and enforce multi-factor authentication to mitigate potential account takeovers.