kra29at[.]net

kra29at.net, a domain impersonating Google, has been flagged as malicious by 15 out of 95 vendors on VirusTotal. Despite its current offline status, the domain previously posed a significant threat, leveraging the trust associated with Google's brand. PhishDestroy identified this domain on March 29, 2026, highlighting its role in phishing activities.

The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted on an IP address associated with CloudFlare, Inc., located in Canada. The SSL certificate was issued by Google Trust Services, which may have been used to further deceive victims into believing they were interacting with legitimate Google services. The platform risk score for kra29at.net was 73 out of 100, indicating a high level of threat potential.

kra29at.net's page title, "KRA29.AT - Авторизация krab9.at," suggests it targeted Russian-speaking users, possibly aiming to harvest credentials or distribute malware under the guise of Google authentication. The domain's presence on a public blocklist underscores its malicious intent. Although the site is now offline, its existence serves as a reminder of the sophisticated tactics employed by cybercriminals to exploit trusted brands for phishing scams.