kra32--cc--at[.]sbs

This domain, kra32--cc--at.sbs, was set up as a generic phishing site, designed to trick visitors into surrendering sensitive information. The page title, "Welcome to nginx!", suggests it may have been used to host fake login pages or credential harvesting forms, often targeting users of cryptocurrency platforms or financial services. The threat level is elevated because the site was active and listed on a security blocklist, posing a real risk to anyone who might have stumbled upon it.

The evidence against this domain is strong. VirusTotal shows that 8 out of 95 security vendors flagged it as malicious, and it appears on one security blocklist. AlienVault OTX also found it in a threat intelligence pulse. The domain was created on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar sometimes associated with suspicious registrations. Fortunately, the site is now offline, meaning the immediate risk is contained, but the infrastructure could be reused under a different domain.

If you visited this site, you should change any passwords or credentials you might have entered there immediately. Enable two-factor authentication on your accounts and monitor for unusual activity. Run a security scan on your device using reputable antivirus software. Finally, report the domain to your email provider or security team to help protect others from similar threats.