kra51-at[.]net

This domain, kra51-at.net, is identified as a credential theft operation impersonating the KRA51 brand, a known entity in cryptocurrency or financial services. The page title, 'kra51.at - Официальный домен KRA51,' explicitly mimics an official domain, suggesting an intent to deceive users into submitting login credentials or sensitive information. No direct evidence of a cryptocurrency drainer kit was observed, but the domain’s structure and branding align with credential harvesting tactics commonly used in phishing campaigns targeting financial or crypto-related services. Analysis of technical indicators reveals multiple high-risk attributes. The domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.0.167, a Cloudflare-associated IP that has been linked to other suspicious activities. Detection engines flagged the domain in 7 out of 95 security vendor scans on VirusTotal, while Gridinsoft assigned it a trust score of 0/100. The domain appears on one security blocklist and was included in a single threat intelligence pulse on AlienVault OTX. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the domain’s malicious intent. As of the latest assessment, kra51-at.net has been taken offline, likely due to enforcement actions by hosting providers or security entities. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to newly registered lookalike domains. Organizations and users are advised to monitor for similar impersonation attempts, particularly those targeting KRA51 or related brands. Blocking the domain and its associated IP at the network level is recommended to prevent potential re-emergence. Continuous threat intelligence monitoring is essential to detect and mitigate follow-up campaigns leveraging comparable tactics.