kra31-at[.]top

This domain, kra31-at.top, operates as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the infrastructure mimics legitimate login flows, likely targeting financial or cryptocurrency platforms, where victims unknowingly submit sensitive credentials to attacker-controlled servers. The use of Cloudflare and HTTP/3 suggests efforts to obscure malicious activity and evade detection by leveraging encrypted traffic and content delivery networks. Infrastructure analysis reveals concrete indicators of compromise: the domain was registered on March 29, 2026, through 耐思尼克国际集团有限公司, a registrar frequently associated with high-risk domains. VirusTotal detections show 4 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain resolves to the IP address 188.114.97.3, a Cloudflare edge node, which further complicates attribution and takedown efforts. The Gridinsoft trust score of 0/100 underscores its classification as a high-confidence threat. Users who visited kra31-at.top should immediately take corrective actions to mitigate potential credential theft. First, revoke any sessions or tokens associated with accounts accessed via the domain. Second, reset passwords for all accounts where the same credentials may have been reused, prioritizing financial and email services. Third, monitor linked accounts for unauthorized transactions or login attempts. If credentials were entered, assume compromise and enable multi-factor authentication where available. Organizations should update blocklists to include this domain and its associated IP address to prevent internal access.