kra14[.]vip

The domain kra14.vip has been identified as a credential harvesting phishing site, actively employed to deceive users into divulging sensitive login information. While the specific brand it attempts to impersonate remains undetermined, the domain fits the profile of a generic credential theft operation rather than targeting a known brand or leveraging a specialized drainer kit. This type of phishing is designed to capture usernames and passwords for malicious use.

Technical indicators reveal kra14.vip was registered on November 20, 2025, through eDomains LLC and resolves to the IP address 103.224.212.207. Its SSL certificate is issued by Let's Encrypt, which does not inherently indicate legitimacy but is used here to provide a secure connection illusion. VirusTotal analysis shows a detection rate of 12 out of 95 security vendors flagging this domain as malicious. There is no record of Google Safe Browsing (GSB) status inclusion, and the domain is currently listed on multiple blocklists, contributing to an elevated risk profile.

As of now, kra14.vip remains active, posing an ongoing threat to users who may be targeted by credential phishing schemes. Security teams and users should avoid interacting with this domain. Immediate response actions include blocking the domain at network perimeters and updating security filters to prevent access. Despite these measures, the domain's current active status and ability to evade detection by some antivirus vendors maintain its elevated risk level. Continuous monitoring and user awareness efforts are essential to mitigate harm from this persistent threat.