kra18-at[.]cc

This domain, kra18-at.cc, is identified as a credential theft phishing operation targeting users through deceptive login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the infrastructure aligns with common credential harvesting tactics. The domain lacks SSL encryption, increasing the likelihood of intercepted data during transmission, and its design likely mimics legitimate authentication pages to trick victims into submitting sensitive information.

Technical indicators confirm elevated risk: the domain is flagged by 14 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is currently blocked by at least one threat intelligence feed. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026, the domain resolves to the IP address 95.85.236.107, hosted by MHost LLC in Germany. The creation date suggests either a typo-squatting attempt or pre-registration for future malicious campaigns, as the timestamp is set abnormally far in the future. No entries were found in Google Safe Browsing at the time of analysis, though this does not mitigate the domain's confirmed malicious status.

As of the latest assessment, kra18-at.cc has been taken offline, reducing immediate exposure risk. However, the infrastructure remains registered and could be reactivated or repurposed for similar attacks. Users who accessed the domain prior to its takedown should assume credential compromise and initiate password resets for any accounts entered on the site. Organizations are advised to monitor network logs for connections to 95.85.236.107 and implement DNS-based blocking of the domain to prevent potential re-emergence. No SSL certificate further underscores the domain's lack of legitimacy, reinforcing the need for heightened scrutiny of unencrypted login portals.