mkrn[.]cc

PhishDestroy identifies mkrn.cc as an active credential-phishing site posing an elevated risk to visitors’ login details. The domain lures users into submitting usernames and passwords to a spoofed interface, which is then harvested by attackers for account takeover and follow-on fraud. Anyone who enters data risks immediate compromise of the linked accounts and potential access to other synchronized services.

This domain was flagged by the research community and registered on 26 January 2025. VirusTotal’s aggregated scan shows only 2 out of 95 participating security vendors currently detect the threat. The domain is hosted on IP address 188.114.96.3 and resolves via a Google Trust Services SSL certificate. The registrant chose NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, a choice that complicates rapid takedown due to the provider’s operational jurisdiction. The page title “k.kraperehodnik.cc” suggests the attackers are abusing a compromised or look-alike subdomain to blend into traffic patterns and evade browser filters.

To mitigate risk, users should never visit or submit data to mkrn.cc or any page that resembles it. Bookmark official login URLs directly and enable multi-factor authentication on every account. Report the domain to your browser vendor and network administrator if encountered. If you have already entered credentials, rotate passwords immediately and enable additional account-recovery options such as backup codes or hardware security keys. Monitor financial and identity records for signs of abuse and consider a password-manager reset across all critical services to sever any potential persistence introduced by credential reuse.