kra331[.]cc

This domain, kra331.cc, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive authentication details. Analysis indicates the infrastructure was configured to mimic legitimate login portals, likely targeting corporate or financial service credentials. The use of Cloudflare and HTTP/3 suggests attempts to evade detection and improve operational security for threat actors. Evidence supporting this assessment includes detection by 15 out of 95 security vendors on VirusTotal, a trust score of 45/100, and presence on one security blocklist. The domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolved to IP address 188.114.96.3. The creation date discrepancy (future-dated) further suggests malicious intent, as this is a common tactic to bypass automated domain reputation checks. Users who visited kra331.cc should immediately revoke any entered credentials, particularly if reused across other platforms. Monitor accounts associated with submitted information for unauthorized access attempts. Clear browser cache and cookies to remove any residual tracking elements. If corporate credentials were exposed, report the incident to internal security teams for further investigation and potential password rotation across all affected systems.