kra32-cc-at[.]top

PhishDestroy identifies an active credential phishing campaign hosted at kra32-cc-at.top marked as generic_phishing with a seed identifier of 92cf09. The domain masquerades as a legitimate service, leveraging a spoofed interface to harvest user credentials. No specific brand or drainer kit has been linked to this campaign as of the initial assessment. The domain resolves to IP address 104.21.39.120 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It holds a valid SSL certificate issued by Google Trust Services and currently maintains a VirusTotal detection score of 1 out of 95 engines. The domain was registered on May 26, 2025, indicating recent activation. Google Safe Browsing has not flagged this domain, and no third-party blocklists currently list it. The threat is currently active and under investigation, with a risk level classified as 'under_investigation.' Immediate response includes domain and IP blocking at the network perimeter to prevent user exposure. The absence of detections and blocklist entries suggests a low public profile, increasing the risk of successful phishing attempts. Users are advised to avoid interacting with this domain, verify URLs before inputting credentials, and report any suspicious activity. Continued monitoring for newly emerging indicators is recommended to refine mitigation strategies.