krd30[.]cc

This domain is flagged at an elevated risk level for credential harvesting phishing, a targeted attack vector designed to steal authentication credentials through fraudulent login interfaces. Analysis indicates the domain was specifically engineered to mimic legitimate services, leveraging social engineering to deceive users into disclosing sensitive information such as usernames, passwords, and multi-factor authentication codes. Infrastructure analysis reveals the domain krd30.cc was registered on March 28, 2026, through Dynadot Inc, and resolves to the IP address 103.224.212.118. It appears on one security blocklist and is detected by 6 out of 95 security vendors on VirusTotal. The domain employs Google Cloud and Nginx technologies, alongside Google Cloud CDN, suggesting a cloud-hosted phishing infrastructure. Gridinsoft trust score for this domain is 0 out of 100, reinforcing its malicious classification. The domain has since been taken offline, though residual risk remains for systems previously exposed to it. Mitigation requires immediate action to prevent credential exposure. Network administrators should block the domain krd30.cc and its resolving IP 103.224.212.118 at the perimeter firewall and DNS filtering layers. Endpoint protection systems should be updated to include this domain in phishing detection rules. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, prioritizing accounts with elevated privileges. Security teams should conduct a retrospective analysis of authentication logs for the period the domain was active to identify potential unauthorized access attempts. Multi-factor authentication should be enforced across all critical systems to mitigate the impact of credential theft.