kra56-at[.]cc

The domain kra56-at.cc has been identified as a credential theft operation designed to mimic CAPTCHA verification pages. Analysis indicates this infrastructure is actively used to deceive users into submitting login credentials under the guise of a security challenge. The domain is currently offline, though prior activity suggests a focus on harvesting authentication details from unsuspecting visitors. Infrastructure analysis reveals the domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.137.207, hosted by a content delivery network provider in Canada. Detection metrics show the domain was flagged by 9 of 95 security vendors on VirusTotal, with a single entry on a security blocklist. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent of the operation. The page title, 'Captcha,' aligns with the observed tactic of impersonating legitimate security prompts to lower user vigilance. As of the latest assessment, kra56-at.cc has been taken offline, likely due to enforcement actions or infrastructure adjustments by the threat actor. Organizations and users are advised to treat any prior interactions with this domain as compromised. Network-level blocking of the IP 172.67.137.207 and monitoring for related domains registered through the same registrar are recommended. Endpoint protection systems should be updated to include this domain in threat intelligence feeds to prevent future exposure.