kra-32[.]com

The domain kra-32.com has been identified as a credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used to collect sensitive authentication credentials. No specific brand impersonation has been confirmed, but the infrastructure aligns with generic phishing campaigns designed to mimic corporate or financial services login pages. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain was created on March 29, 2026, indicating recent deployment for malicious purposes. VirusTotal detection metrics show 8 of 95 security vendors flagged kra-32.com as malicious, with at least one known blocklist (PhishDestroy) actively preventing access. No associated IP addresses were provided in initial intelligence, though historical DNS records may reveal further infrastructure links. The domain appears on a single security blocklist, suggesting early-stage detection before broader dissemination. Current status confirms kra-32.com has been taken offline, though residual risks remain if the domain is reactivated or repurposed. Organizations are advised to implement DNS-based blocking for kra-32.com in perimeter security controls and monitor for related domains using the same registrar or naming patterns. End users should verify login portals via official channels and report any suspicious activity involving this domain to their security teams. Proactive monitoring of newly registered domains with similar characteristics (e.g., hyphenated names, offshore registrars) is recommended to mitigate future threats.