kra24-at[.]cc

This domain, kra24-at.cc, is identified as a credential-harvesting phishing site designed to mimic legitimate login portals. Analysis indicates no direct association with known brand impersonation or crypto drainer kits, but the infrastructure aligns with generic phishing campaigns aimed at capturing user credentials. The lack of SSL certification and the use of a recently registered domain further support its classification as malicious. Technical indicators confirm elevated risk: the domain resolves to IP 95.85.236.107 (hosted in Germany by MHost LLC), was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently holds a VirusTotal detection score of 16/95. It appears on one security blocklist and was previously blocked by endpoint protection systems. The domain lacks SSL encryption, a common red flag for phishing infrastructure. As of the latest assessment, kra24-at.cc has been taken offline, reducing immediate exposure. However, residual risk persists due to potential reuse of the domain or migration of the phishing kit to new infrastructure. Organizations are advised to monitor for related indicators, including the registrar and hosting provider, and to update blocklists with the domain and associated IP. Users should verify login portals via official sources and report suspicious activity to security teams.