kra-39-cc[.]com

The domain kra-39-cc.com has been identified as a platform used for fake login phishing attacks. While the specific brand being impersonated is not immediately clear, the domain's purpose is to deceive users into providing sensitive information such as usernames and passwords. The infrastructure and threat vectors associated with this domain indicate a targeted and sophisticated phishing campaign designed to compromise user credentials.

Technical analysis of kra-39-cc.com reveals that the domain has been flagged by 15 out of 95 security vendors on VirusTotal, highlighting its perceived risk. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 104.21.80.168. It was created on March 27, 2026, and is currently listed on one security blocklist. The Google Safe Browsing (GSB) status indicates that the domain is offline, which may suggest that it has been taken down or is no longer active.

As of the latest assessment, kra-39-cc.com is offline, which mitigates the immediate risk to potential victims. However, the domain's historical flagging and blocklist presence indicate that it has been used for malicious activities. Security professionals and network administrators are advised to monitor for any reactivation of the domain and to ensure that it remains blocked in their security policies. Users should be educated on the signs of phishing attacks and encouraged to verify the legitimacy of login pages before entering any sensitive information.