krakn32at[.]com

PhishDestroy has identified krakn32at.com as an active crypto drainer domain designed to steal cryptocurrency assets from unsuspecting users. This domain engages in phishing by impersonating legitimate cryptocurrency platforms or services to trick victims into connecting their wallets or entering sensitive credentials. The infrastructure associated with this domain suggests it is part of a broader crypto-draining operation, leveraging deceptive tactics to initiate unauthorized transactions from victims' digital wallets. This domain resolves to IP address 104.21.27.169 and was registered on March 27, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal analysis indicates a low detection rate with only 2 out of 95 security vendors flagging this domain as malicious as of the latest scan. The domain holds a valid SSL certificate issued by Google Trust Services, which may be used to enhance its credibility and bypass some security filters. While not currently listed on Google Safe Browsing (GSB), the domain remains active and presents an elevated risk due to its crypto-draining nature and low detection score. As of this assessment, krakn32at.com remains active and poses an elevated risk to users engaging with crypto-related platforms. Immediate actions include blocking this domain at the network perimeter and advising all users to avoid interactions with the site. The low VirusTotal detection rate suggests this domain may not yet be widely recognized by automated security tools, increasing the need for proactive user verification. While mitigation efforts are underway, ongoing monitoring is required due to the domain's recent creation and active status. Users are strongly advised to verify any unknown crypto-related domains using PhishDestroy before engaging to prevent potential asset loss.