kra2c[.]cc

PhishDestroy identifies kra2c.cc as an active credential-harvesting domain designed to trick users into surrendering sensitive login credentials. The site mimics a legitimate service, luring victims to a spoofed login page where entered credentials are immediately exfiltrated to attacker-controlled infrastructure. This is not a theoretical risk; the domain is currently resolving to 172.67.132.164 and has already been flagged by 7 out of 95 VirusTotal security vendors, indicating confirmed malicious activity. This domain was flagged based on multiple indicators of compromise. It was registered on April 04, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk registrations. The domain uses a Google Trust Services SSL certificate to appear legitimate, but the combination of recent creation, low detection ratio, and active hosting strongly suggests it is part of a targeted phishing campaign. The IP address 172.67.132.164 is associated with known malicious infrastructure used in credential theft operations, particularly against users expecting secure authentication flows. If you visited kra2c.cc, immediately change passwords for any accounts you may have entered. Use a password manager to generate and store new, unique credentials. Scan your device for malware using reputable antivirus tools, as phishing sites often deploy info-stealing trojans. Report the domain to your security team or use PhishDestroy’s blocklist to prevent further exposure. Avoid clicking links in unsolicited emails or messages, and verify website authenticity via official channels before entering credentials.