kpa33[.]cc

PhishDestroy identifies kpa33.cc as an active credential theft domain weaponized in a live phishing campaign (seed 5cbae1). The domain resolves to 104.21.19.213 and operates under a Google Trust Services SSL certificate, which attackers use to lend false legitimacy to spoofed login pages. Analysis confirms the infrastructure is configured to harvest user credentials under the guise of a legitimate service, exposing victims to immediate account takeovers and financial loss. This domain was flagged by 5 out of 95 VirusTotal security vendors at time of detection. It was registered on January 23, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently abused in low-cost bulk domain registrations. The short domain age and clean SSL status are consistent with fast-flux phishing operations designed to evade detection. The low detection ratio highlights the challenge of identifying new, low-signal credential theft domains in real time. Users who visited kpa33.cc should immediately check browser history and disable any saved credentials on the site. Change passwords for accounts entered on this domain across all online services, especially email and financial platforms. Enable multi-factor authentication on all critical accounts. Report the domain to your security team or via abuse channels, and consider blocking 104.21.19.213 at the network perimeter. Monitor accounts for unusual activity for at least 30 days following exposure.