kra35--at[.]cc

PhishDestroy identifies kra35--at.cc as an active credential theft phishing domain masquerading as a legitimate authentication portal. The page employs generic branding to lure victims into submitting login credentials under false pretenses, with no evidence of a crypto drainer kit or specific brand impersonation beyond opportunistic deception. Registrants are prompted to input credentials that are likely harvested for unauthorized access to targeted accounts, enabling follow-on attacks such as account takeover or lateral movement within compromised environments. This domain was flagged by 15 out of 95 VirusTotal security vendors and appears on one public blocklist, including OISD. The infrastructure resolves to IP 185.226.92.168, which is associated with hostile hosting activity. The domain was registered on July 16, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and secured a Let’s Encrypt SSL certificate to enhance its perceived legitimacy. Google Safe Browsing has not yet flagged the domain, indicating a window of opportunity for threat actors to exploit before widespread detection. As of current analysis, kra35--at.cc remains active and unblocked by major browsers. Immediate containment is advised via DNS and firewall blocking of the domain and associated IP. Users should be alerted to avoid interaction and verify any suspicious login prompts through official channels. Despite moderate detection coverage, the recent creation date and low blocklist presence suggest elevated risk potential. Organizations are urged to implement strict access controls and monitor for anomalous authentication activity linked to this domain.