kra9-at[.]net

This domain is flagged as an elevated-risk credential harvesting phishing endpoint targeting user authentication data. Analysis indicates the infrastructure is designed to mimic legitimate login portals, tricking victims into submitting sensitive credentials through deceptive web forms. The threat type aligns with generic_phishing, where attackers exploit social engineering to capture usernames, passwords, and multi-factor authentication codes for subsequent unauthorized access. Infrastructure analysis reveals the domain kra9-at.net was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026, and resolves to IP address 95.85.236.107 hosted by MHost LLC in Germany. VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently offline. No SSL certificate is present, increasing the likelihood of plaintext credential transmission. The creation date suggests potential domain squatting or pre-registration for future malicious campaigns. Mitigation requires immediate blocking of the domain kra9-at.net and its resolving IP 95.85.236.107 at network perimeter devices. Security teams should implement DNS sinkholing to prevent resolution attempts from internal hosts. Endpoint protection systems must be updated to detect and quarantine any processes attempting to connect to this domain or its associated IP. User awareness training should emphasize verifying SSL certificates and domain authenticity before entering credentials. Log analysis should focus on failed or unusual authentication attempts, particularly from endpoints that may have interacted with this domain prior to takedown.