karak[.]xn--networkappv2-7g0gd[.]xn--karakappstakedefi-gm3jdfe[.]apps-karak-network[.]xyz

The domain karak.xn--networkappv2-7g0gd.xn--karakappstakedefi-gm3jdfe.apps-karak-network.xyz was registered on February 21, 2026 and is classified as a crypto‑drainer scam. Analysis shows the site resolves to the IPv4 address 45.88.138.177, which belongs to the autonomous system AS213737 operated by AYOSOFT LTD and is geolocated in Bulgaria. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal reports that 2 of 93 security vendors have flagged the domain, indicating limited but non‑trivial detection by reputable scanners.

The site presents a page title of “KARAK - Bağlantı Kurduk, Yarattık”, which aligns with the observed Turkish‑language phrasing often associated with malicious campaigns targeting regional users. Reputation services provide a Gridinsoft trust score of 0 out of 100, and the SSL certificate rating is recorded as R10, suggesting a low‑quality or self‑signed certificate that offers minimal protection. The overall risk level has been set to elevated, and the current operational status is offline, reflecting that the hosting appears to have been taken down or otherwise rendered inaccessible.

Defenders should update their URL filtering and DNS sinkhole rules to include the full punycode domain and the IPv4 address 45.88.138.177, monitor for any re‑use of the IP block or ASN by related indicators, and enforce strict verification of any crypto‑related transaction requests originating from Turkish‑language content. Continuous observation of blocklist feeds and periodic rescans on VirusTotal are recommended to capture any changes in detection counts. Given the limited detection footprint, threat‑intel teams should treat the domain as a low‑visibility but elevated‑risk actor and prioritize correlation with other observed crypto‑drainer activities.