krakn30cc[.]com

PhishDestroy identifies krakn30cc.com as an active generic phishing domain designed to masquerade as a legitimate login interface and steal user credentials. This recently registered domain (March 27, 2025) leverages a Google Trust Services SSL certificate to appear trustworthy, yet 14 out of 95 VirusTotal security vendors have already flagged it as malicious. Resolving to 172.67.187.28, the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting high volumes of disposable domains frequently weaponized in credential theft campaigns.

The elevated risk posed by krakn30cc.com stems from its deployment as a spoofed login page, likely crafted to harvest usernames, passwords, and multi-factor authentication codes under the guise of a legitimate service. The domain’s short operational window and rapid detection by nearly 15% of analyzed security tools underscore a high-confidence threat classification. Given its age (under 24 hours at detection), the infrastructure may still be in early-stage distribution via phishing emails, social media lures, or malvertising, aiming to ensnare unwary victims before broader blacklisting occurs.

Users who have interacted with krakn30cc.com should immediately reset passwords for any accounts exposed during the visit and enable multi-factor authentication where possible. Ensure all devices are scanned for malware, as this domain may also drop infostealers or keyloggers. Report the domain to your security team or via abuse channels provided by NICENIC INTERNATIONAL GROUP CO., LIMITED and local CERT teams. Block the IP 172.67.187.28 and domain at network perimeter to prevent further compromise, and remain vigilant for follow-on phishing attempts leveraging stolen credentials.