kra-31[.]net

PhishDestroy identifies kra-31.net as an active credential-harvesting domain deployed on April 10, 2025. The page masquerades as a legitimate login portal to harvest user credentials. No specific brand or drainer kit family has been tied to this infrastructure yet, indicating a generic but functional phishing template designed for rapid deployment and credential exfiltration.

Technical indicators are definitive: kra-31.net scored 3 out of 95 detections on VirusTotal, resolving to IP 172.67.140.102 with a Google Trust Services SSL certificate. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 10, 2025, placing its age at less than one day at the time of initial detection. Google Safe Browsing has not yet listed this domain, and the low VT score suggests evasion tactics are currently succeeding against a minority of scanners.

Current status remains active and unblocked across major browsers and security layers. No takedown or remediation actions have been recorded as of the latest assessment. Remaining risk is elevated due to the domain’s fresh registration, HTTPS certificate presence, and lack of inclusion on blocklists. Users interacting with this domain risk immediate credential compromise. Immediate network-level blocking of 172.67.140.102 and domain-level blocking of kra-31.net are recommended to prevent further exploitation.