kra42cc[.]com

This domain, kra42cc.com, operates as a credential harvesting platform disguised as an environmental awareness website. The page title, 'Экология и забота о природе — Новая kra42 cc Ссылка,' suggests a Russian-language phishing campaign targeting users with fake ecological content to lure them into entering login credentials or personal information. Analysis indicates the site employs social engineering tactics to exploit trust in environmental causes, a common technique in targeted phishing operations. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.149.120 and has been flagged by 4 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain appears on one security blocklist and was previously documented in one threat intelligence pulse on AlienVault OTX. These technical indicators suggest a coordinated effort to evade detection while maintaining operational persistence. Users who visited kra42cc.com should immediately revoke any credentials entered on the site, as they may have been compromised. It is recommended to monitor accounts linked to the submitted information for unauthorized activity and enable multi-factor authentication where available. System administrators should update network security policies to block the domain and its associated IP address, 172.67.149.120, to prevent further exposure. If financial or sensitive data was submitted, affected individuals should report the incident to relevant authorities for further mitigation.