kra-34[.]cc

This domain, kra-34.cc, is identified as a brand impersonation phishing site specifically targeting the legitimate service kra34. Analysis confirms its current status as offline, though it previously hosted malicious content designed to deceive users into disclosing credentials or sensitive information under the guise of the legitimate platform. The page title, 'Kra34.cc – вход на kra34,' explicitly mimics the branding and language of the authentic kra34 service, reinforcing its deceptive intent. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on November 6, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 104.21.55.124. It is flagged by 14 of 95 security vendors on VirusTotal, and appears on at least one security blocklist. The domain holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. Detected technologies include Cloudflare, Cloudflare Browser Insights, and HTTP/3, while its SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing infrastructure. Given its confirmed malicious activity and current offline status, this domain remains a latent threat. Organizations and users are advised to block all resolutions to 104.21.55.124 and monitor for re-registration or DNS changes. Security teams should update endpoint protection rules to include kra-34.cc and its associated IP in deny lists. Users who may have interacted with this domain should immediately reset credentials for the impersonated service and review accounts for unauthorized activity. Continuous monitoring of newly registered domains with similar naming patterns is recommended to preempt further impersonation attempts.