kra30at[.]net

PhishDestroy identifies kra30at.net as an actively deployed cryptocurrency drainer site designed to mimic legitimate exchange login portals and extract wallet credentials. This domain is currently weaponized to harvest seed phrases and private keys under the guise of a trading platform, indicating a high-fidelity impersonation attack aimed at digital asset owners. Security telemetry confirms kra30at.net functions as a live phishing endpoint with no active takedown countermeasures as of seed 192fb8. Domain analysis confirms kra30at.net operates as a generic phishing vector with no direct affiliation to any established financial brand. The infrastructure behind this site is deliberately provisioned to facilitate credential theft and cryptocurrency theft through fraudulent deposit address interception. No publicly known drainer kit signature matches have been formally attributed to this host, suggesting either an emergent deployment or proprietary tooling. The domain itself was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on February 08, 2025, indicating a deliberately recent setup to minimize historical detection. Technical indicators are unambiguous: VirusTotal reports a detection score of 1/95 security vendors, registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolution maps to IP 188.114.97.3. The domain holds a valid SSL certificate issued by Google Trust Services, which may assist in lowering user suspicion during interaction. No blocklist counts are yet publicly recorded, underscoring the novelty and low retention time of the campaign. The creation date falls within a 24-hour window of discovery, suggesting rapid deployment and current live status. Current operational status remains active with no visible mitigation in DNS or hosting layers. Immediate user action includes blocking kra30at.net at the network perimeter and avoiding all wallet connections or login prompts. This domain represents an elevated but isolated threat; however, rapid expansion through social engineering vectors (e.g., fake airdrop promotions) is plausible due to its recent registration. Persistent risk remains as long as the infrastructure remains online and SSL certificate validity persists, enabling trust exploitation. Users are advised to cross-reference all crypto-related URLs against reputable blocklists and to enable hardware wallet confirmation for all transaction approvals.