at-kra18[.]cc

This domain is flagged as a credential harvesting phishing site designed to deceive users into submitting login credentials, payment details, or other sensitive authentication data. Infrastructure analysis reveals the domain mimics legitimate authentication portals, likely targeting corporate or financial service users through fraudulent login prompts or fake verification requests. The threat is classified as elevated due to its direct impact on data confidentiality and potential for account compromise. Analysis indicates the domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 95.85.236.107, hosted by MHost LLC in Germany, and currently lacks SSL certification, increasing the risk of unencrypted data interception. Security vendors on VirusTotal flagged the domain with 13/95 detections, and it appears on one security blocklist, confirming its malicious classification. The domain has since been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Users who visited at-kra18.cc should immediately revoke any credentials entered on the site, particularly if reused across other platforms. Monitor accounts for unauthorized activity, including login attempts, financial transactions, or profile changes. If authentication data was submitted, enable multi-factor authentication on all associated accounts and review connected devices for signs of compromise. Network administrators should block the domain and its resolving IP (95.85.236.107) at the perimeter to prevent further exposure. Retain logs of any interactions with the domain for forensic analysis if unauthorized access is suspected.