krn2web[.]cc

This domain, krn2web.cc, operates as a credential harvesting platform designed to mimic legitimate financial service portals. Infrastructure analysis reveals the site employs HTTP/3 over Cloudflare to obfuscate its true origin (188.114.96.3), a tactic commonly used to evade detection while collecting sensitive user data such as usernames, passwords, and multi-factor authentication codes. The phishing pages are engineered to replicate the visual and functional elements of targeted institutions, increasing the likelihood of successful compromise. Evidence confirms the malicious nature of krn2web.cc through multiple technical indicators. The domain was registered on April 05, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The domain’s trust score of 0/100 further corroborates its classification as a confirmed threat. At the time of analysis, the site displayed a 522: Connection timed out error, suggesting it may have been taken offline or shifted to alternative infrastructure. Users who accessed krn2web.cc should immediately revoke any credentials entered on the site and monitor associated accounts for unauthorized activity. It is recommended to perform a full scan of the device used to visit the domain to detect potential malware or backdoors. Financial institutions should be notified if banking details were exposed, and users should enable additional authentication measures such as hardware tokens or app-based verification. Network administrators are advised to block the domain and its resolving IP (188.114.96.3) at the perimeter to prevent further exposure.