kuarax[.]com

PhishDestroy identifies kuarax.com as an active threat with an elevated risk level, specifically involved in credential harvesting phishing. This type of attack aims to steal login credentials by mimicking legitimate sites to deceive users.

The domain kuarax.com was created recently on March 26, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.163.196 and uses a Let's Encrypt SSL certificate, which can lend a false sense of security. VirusTotal analysis shows that 7 out of 95 security vendors have flagged this domain, reinforcing its malicious nature. Currently, kuarax.com is not listed on major blocklists but maintains a low trust score due to its recent registration and suspicious activity.

To mitigate risks associated with this credential harvesting threat, organizations should enforce strict email filtering rules and endpoint protections to detect and block access to kuarax.com. User education focused on recognizing phishing attempts is critical, as is the use of multi-factor authentication to reduce credential compromise impacts. Continuous monitoring and timely blacklisting of the domain will also help in reducing exposure to this active threat.