kra13[.]co

This domain is flagged as an active credential theft operation designed to harvest user login credentials through deceptive CAPTCHA verification pages. Analysis indicates the site employs social engineering tactics to trick users into submitting sensitive information, including usernames, passwords, and potentially multi-factor authentication codes, under the guise of a security check. The infrastructure and page design closely mimic legitimate CAPTCHA services, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple high-risk indicators. The domain kra13.co was registered on November 08, 2025, through Virtualia LLC, a registrar frequently associated with malicious activity. It resolves to the IP address 172.67.154.117, which is part of a network known for hosting phishing and fraudulent sites. The domain is currently listed on two security blocklists, including PhishDestroy and OISD, and is flagged by 4 out of 95 security vendors on VirusTotal. The site employs Cloudflare and Cloudflare Browser Insights, likely to obfuscate its true origin and evade detection. Additionally, the domain holds a Gridinsoft trust score of 0/100, further confirming its malicious nature. The SSL certificate issued by Google Trust Services does not mitigate the risk, as it is commonly used by both legitimate and fraudulent sites to appear trustworthy. To mitigate the risks posed by this credential theft operation, organizations and users should implement the following measures. First, block the domain kra13.co and its associated IP address 172.67.154.117 at the network level using firewalls or DNS filtering solutions. Second, deploy browser-based security controls to prevent users from accessing the site, even if it reappears under a different domain or IP. Third, conduct user awareness training to educate individuals on recognizing deceptive CAPTCHA pages, particularly those that request login credentials or personal information. Fourth, monitor for unusual authentication attempts or failed login activities that may indicate compromised credentials. Finally, implement multi-factor authentication (MFA) across all critical systems to reduce the impact of credential theft, even if login details are successfully harvested by the attackers.