kra-29[.]cc

This domain, kra-29.cc, is identified as a fraudulent cryptocurrency exchange login portal designed to harvest user credentials and private keys. Analysis indicates the site mimics legitimate exchange interfaces, employing cloned branding and fake login prompts to deceive victims into entering sensitive account information. The domain specifically targets users of popular cryptocurrency platforms, redirecting them to a spoofed interface where entered credentials are captured in real time and transmitted to attacker-controlled infrastructure. The threat extends beyond credential theft, as the site may also deploy malicious scripts to drain connected wallets or prompt victims to authorize fraudulent transactions under the guise of security verification or account upgrades. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 95.85.236.107, hosted by MHost LLC in Germany, and currently appears on one security blocklist. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious, with detections including phishing, fraudulent exchange, and credential harvesting classifications. Notably, the domain lacks an SSL certificate, further reducing its legitimacy and increasing the likelihood of interception of transmitted data. The domain was taken offline following detection, though residual DNS records and cached content may still pose risks. Users who visited kra-29.cc or entered credentials on the site should assume their account information has been compromised. Immediate steps include revoking all active sessions on the legitimate exchange, changing passwords using a secure device, and enabling multi-factor authentication if not already active. All connected cryptocurrency wallets should be audited for unauthorized transactions, and any suspicious activity should be reported to the legitimate exchange and relevant blockchain explorers. Users are advised to monitor their accounts for phishing attempts via email or SMS, as harvested credentials may be used in follow-up attacks. If wallet access was granted or private keys were entered, affected wallets should be considered fully compromised, and funds should be transferred to a new, secure wallet address. Clearing browser cache and running a full antivirus scan on the device used to access the site is recommended to mitigate secondary infections.