kra-34-at[.]cc

kra-34-at.cc is currently active and hosting a fake invoice phishing campaign, according to PhishDestroy’s ongoing threat intelligence monitoring. This domain is not yet widely flagged by security vendors but is actively distributing fraudulent invoices to deceive victims into transferring funds or disclosing sensitive credentials. The campaign remains under active investigation as analysts assess its scope and impact.

This domain was flagged by 8 of 95 VirusTotal vendors at the time of analysis, indicating low detection rates despite its malicious activity. It resolves to IP address 104.21.16.24 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was created on February 09, 2025, and currently holds a valid SSL certificate issued by Google Trust Services, which may be leveraged to appear legitimate. As of now, kra-34-at.cc has not been listed on any major blocklists, though its recent creation and low detection rate warrant immediate attention.

The threat remains active, with no confirmed takedown or mitigation efforts in place. Organizations and individuals are advised to block kra-34-at.cc at the network perimeter and inspect DNS logs for any recent resolutions to 104.21.16.24. Users should avoid engaging with any invoices or payment requests originating from this domain and report suspicious activity to their security teams. Further updates will be provided as the investigation progresses.