krn-link[.]cc

The domain krn-link.cc is currently flagged as an active crypto drainer phishing scam by PhishDestroy threat intelligence. This malicious site mimics legitimate services to trick users into connecting crypto wallets, enabling unauthorized fund transfers. While no specific drainer kit signature was identified in available telemetry, the domain's behavior aligns with known campaigns targeting cryptocurrency users through fraudulent links and impersonation tactics.

Technical indicators confirm elevated risk: VirusTotal flags this domain with an 11/95 detection ratio, indicating partial visibility among security vendors. It resolves to IP address 86.54.25.38 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 13, 2025. Google Safe Browsing has not yet flagged the domain, and additional blocklist coverage remains limited at this time.

As of today, krn-link.cc remains active with an elevated threat status. Users should immediately block the domain at network and endpoint levels while avoiding any interaction. The domain poses significant risk to cryptocurrency holders through wallet-draining attacks. Security teams should monitor for new registrations from this registrar or IP space, and consider proactive takedown requests where possible.