kra-45-cc[.]com

PhishDestroy identifies active credential theft infrastructure at kra-45-cc.com, a recently registered domain impersonating a cryptocurrency wallet service. This infrastructure poses an immediate risk to users who may unknowingly enter login credentials or financial information, believing they are accessing a legitimate service. The domain’s recent creation date and low detection rate on VirusTotal suggest it is a newly deployed threat designed to evade early detection mechanisms. This domain was flagged by only 1 security blocklist and remains undetected by 95 VirusTotal engines despite its active status. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 25, 2025, the domain resolves to IP 188.114.97.3 and utilizes a Google Trust Services SSL certificate, adding a veneer of legitimacy to deceive potential victims. These technical indicators highlight a sophisticated attempt to blend into normal web traffic while avoiding immediate detection. Users who visited kra-45-cc.com should immediately cease any interaction with the site and avoid entering any credentials or financial information. If credentials were entered, change passwords immediately and enable multi-factor authentication on all related accounts. Monitor financial transactions for unauthorized activity and report any suspicious behavior to your financial institution. Additionally, clear browser cache and cookies associated with the domain to prevent potential session hijacking. Vigilance and prompt action are critical to mitigating the risks posed by this active threat.