kra--50[.]cc

The domain kra--50.cc has been identified as an active phishing site engaged in a credential theft campaign targeting unsuspecting users. This domain is currently live and poses an elevated risk to anyone who accesses it, as it is designed to mimic a legitimate service in order to harvest login credentials or sensitive information. The deceptive nature of the domain, combined with its active status, makes it a credible threat to user security.

PhishDestroy identifies kra--50.cc as a generic phishing domain that was flagged by 9 of 95 VirusTotal security vendors, indicating significant but not universal detection across security platforms. The domain resolves to IP address 188.114.97.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It was created on September 01, 2025, and currently holds an SSL certificate issued by Google Trust Services. Despite the presence of a valid SSL certificate, the domain's malicious intent is evidenced by its inclusion in multiple threat intelligence feeds and low trust scores among cybersecurity vendors.

As of the latest assessment, kra--50.cc remains active and poses a high risk to users who may interact with it under the false impression of legitimacy. The domain's recent creation date, combined with its low detection rate on VirusTotal, suggests it may be a newly deployed threat with potential to evade some security measures. Users are strongly advised to avoid accessing this domain and to verify the authenticity of any similar service through official channels. Organizations are recommended to update firewall and DNS blocklists to include this domain and its associated IP address immediately. Additionally, users who may have already entered credentials on this domain should change their passwords and enable multi-factor authentication wherever possible.