kra33-at[.]sbs

PhishDestroy identifies kra33-at.sbs as a credential harvesting domain engaged in an active phishing campaign. This domain poses a high risk due to its recent creation and low detection rates on security platforms. Analysis indicates it is designed to mimic legitimate services to trick users into entering sensitive credentials. kra33-at.sbs was registered on June 06, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to IP address 104.21.50.128 and currently has 0 detections out of 95 VirusTotal scans. Despite using a Google Trust Services SSL certificate, the lack of flagging suggests this domain is either newly operational or employing evasion techniques. The domain’s age and infrastructure alignment with known phishing patterns warrant immediate scrutiny. Users who encountered this domain should avoid clicking any links or entering credentials. If visited, check for unauthorized account access, change passwords for affected services, and scan devices for malware. Report the domain to security teams and blocklist it locally. Enterprises should update firewall rules to block traffic to 104.21.50.128 and inspect DNS logs for related queries. This domain remains under investigation, and additional indicators will be shared as they emerge.