kra19a-at[.]com

The domain kra19a-at.com has been identified as a high-risk phishing infrastructure specifically designed to impersonate cryptocurrency wallet platforms, targeting user credentials, private keys, and recovery phrases. Analysis indicates this domain operates as a credential harvesting endpoint, likely distributing fraudulent login interfaces or wallet recovery prompts to deceive victims into disclosing sensitive authentication details. As of the latest assessment, the domain has been taken offline, though its prior activity remains a documented threat vector in recent phishing campaigns. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domain registrations. It resolves to the IP address 185.226.92.168, geolocated in Turkey and hosted on infrastructure previously linked to phishing and malware distribution. The domain appears on three security blocklists, and detection engines flagged it in 13 of 95 VirusTotal vendor scans, with detection labels including generic phishing and cryptocurrency-related fraud. The SSL certificate, issued by Let's Encrypt (R13), was likely automated to lend superficial legitimacy to the fraudulent site, a common tactic in phishing operations. Current status confirms the domain is offline, though residual risk persists due to potential re-registration or migration to alternative infrastructure. Organizations and end-users are advised to implement DNS-based blocking for 185.226.92.168 and kra19a-at.com, update endpoint protection signatures to include this indicator, and conduct retrospective log analysis for connections to the domain or IP. Cryptocurrency wallet users should verify all login interfaces against official sources and enable multi-factor authentication where available. Security teams are recommended to monitor for domains with similar naming patterns (e.g., alphanumeric prefixes/suffixes) registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, as this registrar remains a recurring vector for phishing infrastructure.