kra5l[.]cc

The domain kra5l.cc is identified as a generic phishing domain with an elevated risk level. No specific brand or drainer kit is associated with this domain. The primary threat posed by kra5l.cc is the potential for credential theft and financial fraud through deceptive web pages designed to mimic legitimate sites.

Technical analysis reveals that kra5l.cc has a VirusTotal score of 10/95, indicating that 10 out of 95 security vendors flag this domain as malicious. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.96.3. It was created on March 26, 2026. The domain uses an SSL certificate from Google Trust Services, which can lend a false sense of security to unsuspecting users. Additionally, the infrastructure analysis shows that the domain employs Cloudflare Browser Insights and Cloudflare, and supports HTTP/3. The domain currently appears on 2 security blocklists, further corroborating its malicious nature.

As of the latest assessment, kra5l.cc is offline. This status suggests that the domain may have been taken down by authorities or the hosting provider in response to its malicious activities. However, the offline status does not eliminate the remaining risk, as the domain could be reactivated or used in future campaigns. Security professionals and users are advised to remain vigilant and ensure that any related IP addresses and registrars are monitored for potential re-emergence of the threat. Additionally, implementing DNS-based blocking and updating security solutions to include the domain in their threat intelligence databases can help mitigate the risk.