xn--krkn1-8za61q[.]com

This domain, xn--krkn1-8za61q.com, is identified as a phishing site designed to harvest user credentials through a fake login interface. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the domain exhibits characteristics consistent with credential theft operations. The infrastructure appears generic, lacking overt ties to known phishing toolkits, though the use of a punycode domain suggests an attempt to mimic legitimate services or evade detection through homograph techniques. Technical indicators confirm elevated risk: the domain is flagged by 14 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. Registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, it resolves to the IP address 188.114.96.3. The domain appears on one security blocklist and was previously detected in a threat intelligence pulse on AlienVault OTX. The SSL certificate, issued by Let's Encrypt, provides minimal assurance, as it is commonly exploited in phishing campaigns to lend a false sense of legitimacy. As of the latest assessment, xn--krkn1-8za61q.com has been taken offline, likely in response to detection and blocking by security systems. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or repurpose the associated IP for future campaigns. Organizations should monitor for re-activation and ensure endpoint protection systems are configured to block punycode domains with similar patterns. Users are advised to verify domain authenticity before entering credentials, particularly when redirected from unsolicited communications.