kra30c[.]cc

This domain, kra30c.cc, is identified as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the infrastructure mimics legitimate login pages, likely targeting users of cryptocurrency platforms, financial services, or other high-value accounts. The domain employs social engineering tactics, such as urgent prompts or fake security alerts, to trick visitors into entering sensitive information, which is then exfiltrated to attacker-controlled servers. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain is flagged by 14 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026, a date inconsistent with typical domain lifecycle patterns, suggesting potential abuse. The domain appears on one security blocklist and resolves to the IP address 103.224.212.210, hosted by Trellian Pty. Limited in Australia. The SSL certificate, issued by Let's Encrypt (R13), is commonly used in both legitimate and malicious infrastructure, providing minimal assurance of safety. Users who visited kra30c.cc should take immediate action to mitigate potential compromise. If credentials were entered, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. Review connected devices and sessions for unauthorized access, particularly for financial or cryptocurrency accounts. Monitor for unusual activity, such as unauthorized transactions or login attempts, and report any suspicious behavior to the relevant platform. Consider scanning the device used to access the domain for malware, as fake login portals may deploy additional payloads to maintain persistence or exfiltrate further data.