kre47[.]cc

The phishing domain kre47.cc, which mimics krab1.cc, is detected by six out of 95 vendors on VirusTotal. Although the domain is currently offline, it was first flagged by PhishDestroy on December 16, 2025. The domain was registered through NiceNIC International Group Co., Limited and hosted on IP 193.105.134.196 in Sweden, under ASN AS42237 w1n ltd.

Despite its current offline status, kre47.cc had been actively used to deceive users by impersonating krab1.cc. The domain's registration on November 27, 2025, suggests a short-lived operation, typical of phishing campaigns that exploit the window between domain registration and widespread detection by antivirus databases. With six detections on VirusTotal, the domain's malicious nature is confirmed, though it managed to evade many security vendors initially.

The absence of an SSL certificate indicates a lack of security measures, which is common in phishing setups aiming to quickly capture sensitive information without investing in security. The domain's presence on PhishDestroy's blocklist underscores its threat level, even though it is no longer active. This case highlights the importance of timely detection and response to phishing threats, as these domains can cause significant harm during their brief periods of activity.