kra40-at[.]com

This domain is flagged as an elevated-risk phishing infrastructure targeting users through a counterfeit KRA portal interface. Analysis indicates the threat type is credential harvesting, specifically designed to mimic official tax authority login pages to steal sensitive financial and personal data. Infrastructure analysis reveals the domain kra40-at.com was registered on February 07, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 198.18.1.167 and is currently offline. The domain appears on one security blocklist and is detected by 10 out of 95 security vendors on VirusTotal. It employs a Google Trust Services SSL certificate (WE1) to create a false sense of legitimacy, while its page title, KRA40.AT ✅, attempts to deceive users into believing they are accessing an authentic government service. To mitigate risks associated with this phishing threat, organizations and individuals should immediately block the domain and its associated IP address at the network perimeter. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, particularly those related to financial or tax services. Security teams are advised to monitor for indicators of compromise, including the domain registration details, SSL certificate fingerprint, and resolved IP address. Implementing multi-factor authentication on all critical accounts can reduce the impact of credential theft from similar phishing attempts.