kra--33----cc[.]sbs

PhishDestroy identifies the domain kra--33----cc.sbs as an active phishing page impersonating the cryptocurrency exchange Kraken. The threat is classified as a credential harvesting campaign designed to steal user login credentials and financial data. This domain is currently operational and remains unblocked by multiple security vendors, posing an elevated risk to potential victims.

This domain was flagged by 6 of 95 VirusTotal vendors, indicating partial detection across security solutions. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 193.105.134.24, and was created on June 27, 2025. The domain exhibits low trust scores due to its recent creation and lack of legitimate infrastructure. As of the latest scan, no major blocklists include this domain, increasing the window of opportunity for threat actors to exploit unsuspecting users.

The domain kra--33----cc.sbs remains active and should be considered dangerous. Users are advised to avoid accessing this domain and report it to their security teams or relevant authorities. Organizations should implement network-level blocking for this domain and IP address to prevent accidental exposure. Security teams are encouraged to monitor for related domains using the seed identifier 0d8e55 and update threat intelligence feeds accordingly. Immediate action is recommended to mitigate the risk of credential theft and financial fraud.