kra30cc-at[.]top

This domain, kra30cc-at.top, is identified as a phishing portal designed to mimic legitimate cryptocurrency exchange login pages. Users who visit the site may be tricked into entering sensitive credentials, such as wallet keys or exchange passwords, which are then harvested by threat actors. The site specifically targets users familiar with crypto platforms, employing visual spoofing techniques to appear authentic. Analysis of the domain’s infrastructure indicates it was likely set up for short-term malicious campaigns rather than long-term operation. Infrastructure analysis reveals that kra30cc-at.top was registered on March 29, 2026, through the registrar 耐思尼克国际集团有限公司. The domain resolves to the IP address 172.67.163.104 and is currently offline, displaying a 521 error indicating server unavailability. VirusTotal detections show that 4 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. The site was hosted behind Cloudflare, utilizing HTTP/3, which may have been used to obfuscate its true origin and evade initial detection. Users who visited kra30cc-at.top should assume their credentials or wallet information may have been compromised. Immediately revoke any active sessions on legitimate platforms that share the same credentials. Enable multi-factor authentication on all crypto-related accounts and monitor for unauthorized transactions. If wallet keys were entered, transfer remaining assets to a new wallet address. Report the incident to the legitimate platform’s security team and consider filing a report with local cybercrime authorities. Avoid interacting with any communications or links associated with this domain.