kra29cc[.]net

This domain, kra29cc.net, is flagged as a generic phishing site designed to mimic legitimate account access portals. Analysis of the page title 'KRA29.cc - Доступ к аккаунту' indicates a focus on Russian-speaking users, likely attempting to harvest credentials through a fraudulent login interface. No specific brand impersonation or crypto drainer kit signatures were identified, but the generic phishing framework suggests broad targeting of user credentials for unauthorized access or financial fraud. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to IP address 172.67.143.17 and was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. VirusTotal detection shows 15 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, further confirming its fraudulent nature. Technologies detected include Cloudflare, Cloudflare Browser Insights, and HTTP/3, which are often leveraged to obfuscate malicious infrastructure and evade detection. As of the latest assessment, kra29cc.net has been taken offline, likely due to enforcement actions by security providers such as PhishDestroy. However, residual risk remains due to the domain's recent creation date and the use of bulletproof hosting infrastructure. Users who may have interacted with this site are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure across campaigns. Proactive blocking of the identified IP and registrar-associated domains is recommended to mitigate further risk.