kra-4at[.]com

This domain is flagged as an elevated-risk credential harvesting phishing infrastructure targeting user login credentials. Analysis indicates the domain was specifically engineered to mimic legitimate authentication portals, a common tactic in credential theft operations. The threat type aligns with generic_phishing but exhibits characteristics of targeted credential harvesting, including the absence of SSL encryption and a short-lived operational window. Infrastructure analysis reveals the domain kra-4at.com was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolved to the IP address 95.85.236.107, located in Germany and hosted by MHost LLC, a provider with a history of supporting phishing infrastructure. The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal, indicating moderate consensus on its malicious nature. No SSL certificate was detected, further reducing its legitimacy and increasing detection likelihood by security controls. The domain has since been taken offline, though historical resolution data confirms its prior operational status. Mitigation for this threat type involves immediate blocking of the domain and its associated IP address (95.85.236.107) at the network perimeter. Organizations should review logs for connections to kra-4at.com or the hosting IP to identify potential credential exposure. User awareness training should emphasize the risks of entering credentials on unencrypted sites, particularly those with recent creation dates or suspicious registration details. Security teams are advised to monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to MHost LLC infrastructure, as these indicators correlate with known phishing campaigns.