kra-31cc[.]net

PhishDestroy identifies kra-31cc.net as an elevated-risk credential-harvesting domain impersonating a login portal. The site was registered on February 09, 2025, via NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 172.67.165.234. VirusTotal’s 9/95 detection rate, alongside the presence of a Google Trust Services SSL certificate, indicates active deployment of a phishing kit designed to deceive users into submitting usernames, passwords, or sensitive data. This domain has not yet achieved widespread blocklisting but exhibits a combination of red flags. Along with the 9.5% security-vendor detection rate, the newly created registration (Feb 2025) and use of a trusted SSL issuer demonstrate the attackers’ emphasis on legitimacy through valid encryption. The combination of fresh registration and partial detection suggests the campaign is early-stage, evolving, and likely targeting enterprise or cloud service logins. Users should immediately avoid accessing this domain or entering any credentials. Enterprises should block both the domain and IP 172.67.165.234 at the firewall or DNS level. If credentials were previously entered, rotate passwords immediately and enable multi-factor authentication where possible. Report the domain to your security team or through local abuse channels to accelerate takedown efforts.