krad2[.]cc

This domain is flagged as an elevated-risk credential harvesting portal targeting users through generic phishing tactics. Analysis indicates the infrastructure is designed to mimic legitimate authentication pages, tricking victims into submitting sensitive login details such as usernames, passwords, and multi-factor authentication codes. The domain exhibits characteristics consistent with large-scale phishing campaigns, including the use of bulletproof hosting and content delivery networks to evade detection. Infrastructure analysis reveals the domain krad2.cc was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.175.61, hosted by Cloudflare, Inc. in Canada, a common tactic to obscure the true origin of phishing servers. The domain appears on one security blocklist and is actively blocked by enterprise threat intelligence feeds. VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious, with detections including credential theft and phishing indicators. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is often exploited by threat actors to lend false credibility to fraudulent sites. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain krad2.cc and its resolving IP 172.67.175.61 at the perimeter firewall and DNS filtering levels. Security teams are advised to monitor for connections to this IP or domain in logs, particularly from endpoints exhibiting anomalous authentication attempts. End users should be trained to recognize phishing indicators, such as mismatched URLs, urgent language, and requests for credentials outside official portals. If credentials were entered on this domain, affected accounts must be locked, passwords reset, and multi-factor authentication tokens revoked and reissued. Given the domain’s current offline status, defenders should remain vigilant for re-emergence under similar naming conventions or infrastructure.