kra28cc[.]net

PhishDestroy identifies kra28cc.net as an active credential harvesting domain designed to steal user login credentials under the guise of a legitimate service. This domain mimics authentic login portals, luring victims into inputting sensitive information such as usernames and passwords. The attackers behind this campaign leverage social engineering tactics, often disguising the malicious domain as a trusted entity to bypass initial suspicion. Once credentials are submitted, they are immediately exfiltrated to attacker-controlled servers for misuse in further cybercriminal activities, including account takeovers and identity theft. This domain was flagged by PhishDestroy with critical indicators including 0 detections out of 95 VirusTotal engines, indicating it has evaded detection by most antivirus solutions as of the latest scan. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and became active on February 08, 2025. It resolves to the IP address 104.21.74.247, which hosts multiple suspicious domains. Despite the absence of VirusTotal detections, the domain’s recent creation date and lack of reputation suggest a high likelihood of malicious intent, particularly for phishing campaigns targeting unsuspecting users. Users who have visited kra28cc.net should immediately cease any interaction with the site and avoid entering any personal or login credentials. If credentials were entered, change passwords on all associated accounts immediately and enable multi-factor authentication where available. Additionally, users should scan their devices for malware using reputable security software and monitor financial accounts for unauthorized activity. Report the domain to your cybersecurity team or relevant authorities to help prevent further harm. For a detailed analysis and ongoing updates, access the full threat intelligence report linked in the PhishDestroy database.