kkra76[.]cc

The domain kkra76.cc has been identified as a credential harvesting phishing site designed to impersonate legitimate login portals and capture sensitive user credentials. Analysis indicates this domain is currently offline, though prior activity suggests it targeted users through deceptive login interfaces. No specific brand impersonation has been confirmed, but the infrastructure aligns with generic phishing campaigns aimed at credential theft. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 04, 2026, and resolves to the IP address 188.114.97.3. Detection metrics show the domain is flagged by 10 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on two security blocklists, including PhishDestroy and OISD, and employs a Let's Encrypt SSL certificate, a common tactic to lend a false sense of legitimacy. The creation date discrepancy (2026) suggests potential domain age manipulation to evade detection or registration errors. Current status confirms the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, given the elevated risk level and historical detection patterns, organizations and individuals are advised to proactively block the domain and associated IP (188.114.97.3) at the network level. Users should verify the authenticity of login portals before entering credentials, particularly those accessed via unsolicited links. Security teams are encouraged to monitor for related domains registered through the same registrar or resolving to the identified IP, as these may indicate follow-up campaigns.