kra33--at[.]top

This domain, kra33--at.top, is flagged as an elevated-risk fake login portal designed to harvest user credentials. Analysis indicates the infrastructure is specifically engineered to impersonate legitimate authentication pages, tricking victims into submitting sensitive login details. The threat type aligns with credential phishing campaigns, where stolen data is often exploited for unauthorized account access or sold on underground markets. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 193.105.134.22, hosted by a provider in Sweden under w1n Ltd. It appears on one security blocklist and is flagged by 11 out of 95 vendors on a malware detection platform. Registered through 耐思尼克国际集团有限公司 on March 29, 2026, the domain exhibits an anomalous creation date, suggesting potential domain spoofing or pre-registration for malicious use. The SSL certificate, issued to Internet Widgits Pty Ltd, lacks transparency and aligns with patterns observed in phishing infrastructure. The page title, Welcome to nginx!, further indicates a default server configuration, often exploited by threat actors to deploy cloned login pages. Mitigation steps specific to this fake login threat include immediate blocking of the domain and its associated IP (193.105.134.22) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to kra33--at.top or similar patterns. End-users should be trained to verify domain authenticity before entering credentials, particularly when redirected from unexpected sources. Multi-factor authentication (MFA) should be enforced across all critical accounts to mitigate the impact of credential theft. Security teams are advised to monitor for unauthorized access attempts using credentials potentially exposed via this domain, as historical data suggests stolen logins may be exploited within hours of collection.