m[.]kracryptos[.]com

Analysis of the domain m.kracryptos.com shows an active credential phishing infrastructure that was created on May 14, 2026 and is hosted on Cloudflare's network (IP 188.114.96.3, CA). The domain is registered through Gname.com Pte. Ltd. and uses Cloudflare nameservers margaret.ns.cloudflare.com and shane.ns.cloudflare.com. An HTTPS endpoint is present with a Google Trust Services / WE1 certificate, and the web server returns HTTP 200 responses, indicating a functional front‑end. The site is currently listed on three public blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. VirusTotal reports a single detection out of 92 scanned vendors, and Gridinsoft assigns a trust score of 0/100, reinforcing the malicious rating. The specific brand or login portal being spoofed has not been disclosed in the available intelligence, so the exact target of the credential harvest remains uncertain. Defenders should immediately add m.kracryptos.com to URL filtering and DNS block lists, monitor outbound traffic for connections to the associated IP, and consider sinkholing the domain to disrupt future campaigns. Continuous re‑evaluation is advised as additional payload or page content becomes available.