kra29-at[.]com

This domain, kra29-at.com, is flagged as a generic phishing site designed to harvest user credentials through deceptive login interfaces. Analysis indicates no association with legitimate brands or known phishing kits, though its infrastructure aligns with opportunistic credential theft campaigns. The domain exhibits no visible branding, suggesting a broad, untargeted approach rather than a campaign mimicking specific organizations or services. Infrastructure analysis reveals the domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in malicious domain registrations. It resolves to the IP address 95.85.236.107, hosted by MHost LLC in Germany, an autonomous system with a history of hosting phishing and malware distribution sites. At the time of detection, the domain was flagged by 15 out of 95 security vendors on VirusTotal, with no detections from Google Safe Browsing. It appears on a single security blocklist, indicating early-stage detection before broader dissemination. The domain is currently offline, likely taken down following detection by automated security systems. However, the infrastructure remains a residual risk, as the IP address and registrar are still active and may be reused for future phishing campaigns. Users who interacted with the domain prior to takedown should assume credential exposure and initiate password resets on any accounts accessed during the exposure window. Organizations are advised to monitor for similar domains registered through the same registrar or resolving to the identified IP range.