kra35---cc[.]com

This domain, kra35---cc.com, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. Analysis indicates the infrastructure is structured to mimic legitimate authentication portals, likely targeting corporate or financial service credentials. The domain employs obfuscation techniques to evade detection, including the use of Cloudflare hosting to mask its true origin and complicate takedown efforts. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 8 out of 95 security vendors on VirusTotal, with detection labels including 'phishing' and 'fraudulent.' It appears on one security blocklist, specifically PhishDestroy, and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. The domain resolves to the IP address 172.67.141.84, which is geolocated in Canada and associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing pages. Users who have visited kra35---cc.com or entered credentials on any page associated with this domain should take immediate action. First, revoke any submitted credentials, particularly for email, banking, or corporate accounts, and enable multi-factor authentication where available. Second, scan the affected device for malware using updated security tools to detect potential secondary infections. Finally, monitor accounts for unauthorized activity and report the incident to relevant security teams or fraud reporting platforms. The domain is currently offline, but similar infrastructure may resurface under different names.