krak-onion[.]to

This domain, krak-onion.to, is under investigation for credential theft phishing operations. Analysis indicates the infrastructure was designed to harvest login credentials through deceptive landing pages, though the current 404 status suggests temporary takedown or operational pause. The threat type aligns with credential theft rather than generic phishing due to observed patterns in similar campaigns targeting cryptocurrency and financial services users. Infrastructure analysis reveals the domain was registered on October 16, 2025, through the Government of the Kingdom of Tonga registrar. It resolves to IP address 172.67.144.48 and employs Cloudflare services with HTTP/3 protocol support. The SSL certificate is issued by Google Trust Services. Detection metrics show 0/95 detections on VirusTotal, though it appears on one security blocklist and has been documented in two AlienVault OTX threat intelligence pulses. The Gridinsoft trust score of 0/100 further corroborates malicious intent. Mitigation against credential theft phishing requires multi-layered defenses. Network administrators should implement DNS filtering to block resolution of newly registered domains from high-risk registrars. End users should enable multi-factor authentication on all accounts, particularly those involving financial transactions or sensitive data. Security teams should monitor for connections to 172.67.144.48 and similar Cloudflare-resident IPs associated with recent domain registrations. Organizations should also implement credential monitoring services to detect compromised accounts and enforce password rotation policies for any users who may have interacted with the domain prior to its takedown.