kra36x[.]cc

The domain kra36x.cc has been identified as involved in a credential theft campaign. While there is no specific brand impersonation or crypto drainer kit linked to this domain, the primary threat vector is the harvesting of user credentials through deceptive means. This campaign is currently under investigation but remains active, posing a risk to users who may encounter related phishing attempts.

Technical indicators for kra36x.cc include a VirusTotal detection score of 9/95, indicating it has not yet been flagged by antivirus engines. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on July 29, 2025, and resolves to the IP address 104.21.47.157. It holds an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to victims. There is no current Google Safe Browsing block reported, and no other blocklist counts are noted at this time.

Currently, kra36x.cc is active and poses a moderate risk due to its credential theft focus and clean detection status, which may allow it to evade automated defenses. Users should exercise caution by not clicking on suspicious links or providing login information prompted by this domain. Security teams are advised to monitor network traffic for connections to 104.21.47.157 and to update email filtering rules to block communications referencing kra36x.cc. Continued vigilance and timely reporting of incidents involving this domain will help mitigate potential user compromise.