kra-50[.]cc

The domain kra-50.cc has been identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is currently offline, though prior activity suggests it was designed to impersonate legitimate services to extract sensitive authentication details. No specific brand impersonation has been confirmed, but the infrastructure aligns with common phishing tactics used to harvest credentials for financial or corporate exploitation. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026. Security telemetry shows the domain was flagged by 14 of 95 vendors on VirusTotal, with additional detections on one security blocklist. While no associated IP addresses were provided in initial reports, the domain’s registration pattern and detection metrics suggest a deliberate attempt to evade immediate takedown. The elevated risk classification stems from its confirmed phishing activity and the potential for credential misuse if victims engaged with the site prior to its deactivation. Current status confirms kra-50.cc has been taken offline, though residual risk remains for users who may have interacted with the domain during its active phase. Organizations and individuals are advised to monitor for unauthorized access attempts linked to credentials potentially exposed via this campaign. Network administrators should ensure the domain remains blocked at the perimeter, and users should verify any prior interactions with the site through password resets and multi-factor authentication enforcement. Proactive threat hunting for related indicators of compromise is recommended, particularly for entities targeted by credential harvesting attacks.