www--kra-46-cc[.]ru

PhishDestroy identifies www--kra-46-cc.ru as a live crypto drainer domain designed to trick cryptocurrency users into connecting wallets and approving malicious transactions that silently drain funds. The site impersonates a major exchange interface and requests wallet connections under the pretense of KYC verification or airdrop eligibility. Once a victim approves a transaction via wallet signature, the drainer siphons tokens directly from the connected wallet without additional prompts, often targeting ERC-20 and BEP-20 assets. Security researchers have observed redirect chains from compromised social media accounts advertising fake trading bots that ultimately land on this domain, demonstrating an active campaign with human-driven traffic. This domain was flagged by PhishDestroy on the same day it was registered, November 14, 2025, through the Russian registrar Domenus-RU. It resolves to IP 172.67.161.144 and holds a Google Trust Services SSL certificate, which attackers often abuse to appear legitimate. VirusTotal currently shows only 1 out of 95 security vendors detecting the threat, highlighting how new and evasive this campaign remains. The domain name mimics the legitimate Kraken exchange (kraken.com), using a double-hyphen obfuscation technique to bypass visual detection by hurried users. If you visited www--kra-46-cc.ru or connected your wallet to the site, immediately revoke all token approvals using tools like revoke.cash or Etherscan's Token Approval Checker. Disconnect the wallet from your browser, clear cached data, and scan your device with reputable antivirus software. Report the domain to your wallet provider and consider transferring remaining funds to a newly generated wallet with a hardware device. Monitor on-chain activity closely and report any unauthorized transactions to local cybercrime units.