kra-36[.]net

PhishDestroy identifies kra-36.net as an elevated-risk crypto drainer domain deployed on April 10, 2025. This site masquerades as a legitimate service to trick users into approving malicious wallet transactions that silently drain crypto assets. No specific brand was cited in the seed data; however, the domain’s naming convention and recent registration strongly suggest opportunistic impersonation of a crypto service or platform.

Technical indicators confirm elevated risk: kra-36.net resolves to IP 172.67.178.147 and is flagged by 3 out of 95 VirusTotal security vendors. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and secured with a Google Trust Services SSL certificate. Despite this, it remains unlisted on major blocklists at time of analysis. The domain’s recent creation date and low detection ratio indicate a fast-evolving threat likely leveraging short-lived infrastructure for evasion.

As of analysis, kra-36.net remains active and unblocked by default in most browsers and security tools. Users are advised to avoid interacting with this domain entirely. Block the domain at DNS and firewall levels, and report to threat intelligence platforms. Remaining risk is elevated due to active status, low detection coverage, and the use of reputable infrastructure (Cloudflare IP, trusted CA) which can bypass traditional filtering. Immediate defensive action is required to prevent fund loss.