kra-37at[.]com

The domain kra-37at.com has been identified as a credential theft operation specifically designed to impersonate the legitimate platform KRA37.AT. Currently, the domain is offline, but prior analysis confirms its malicious intent to harvest user credentials, financial details, or other sensitive information through deceptive login portals. The threat actors behind this infrastructure employed tactics consistent with targeted phishing campaigns, likely leveraging social engineering to trick victims into disclosing confidential data. Infrastructure analysis reveals critical indicators of compromise. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.53.167, a Cloudflare-associated endpoint commonly used to obfuscate hosting origins. The SSL certificate, issued by Google Trust Services, provided a veneer of legitimacy while failing to mitigate the underlying threat. Security vendors detected the domain with notable consistency: 16 of 95 VirusTotal engines flagged it as malicious, and it appeared on at least one security blocklist, specifically PhishDestroy. Additionally, the domain earned a trust score of 0/100 from Gridinsoft, further corroborating its fraudulent nature. The page title, "KRA37.AT ✅", was deliberately crafted to mimic the legitimate site, exploiting user trust in visual cues. As of the latest assessment, kra-37at.com has been taken offline, likely due to enforcement actions or the threat actors abandoning the infrastructure. However, the risk to users persists, particularly for those who may have interacted with the domain during its active phase. Organizations and individuals are advised to monitor for unauthorized access to accounts associated with KRA37.AT, reset credentials if exposure is suspected, and implement multi-factor authentication as a mitigation measure. Network defenders should block the domain and its associated IP (104.21.53.167) at the perimeter, while security teams should review logs for connections to this infrastructure. Users who encountered the site should treat any submitted data as compromised and remain vigilant for follow-up phishing attempts or identity theft.