krakeshop[.]cc

PhishDestroy identifies krakeshop.cc as an active domain engaged in tech support phishing operations, posing an elevated risk to unsuspecting users. This domain mimics legitimate technical support portals to deceive victims into divulging sensitive information or installing malicious software under the guise of troubleshooting assistance.

Current threat intelligence reveals krakeshop.cc was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 27, 2025, with DNS resolution to IP address 104.21.66.148. VirusTotal analysis confirms 3 of 95 security vendors have flagged this domain, while its SSL certificate is issued by Google Trust Services, potentially enhancing its perceived legitimacy. Despite this, its recent creation date and low blocklist presence—limited to the 3 vendors noted—underscore its recency and unproven operational footprint. The absence of widespread detection suggests a targeted or emerging campaign rather than a large-scale, established threat.

The domain remains active as of this advisory, indicating ongoing malicious activity. To mitigate risk, organizations and individuals should immediately block krakeshop.cc at the network perimeter and avoid any engagement with its associated pages. Users who suspect exposure should scan their systems for unauthorized access or malware, particularly those mimicking tech support interactions. Threat hunting efforts should prioritize the IP address 104.21.66.148 and SSL certificate issuer for lateral correlation. Proactive monitoring for similar recently registered domains is strongly advised due to this campaign’s evolving nature.