# PhishDestroy threat dossier — ikraa.website ================================================================ Fetched: 2026-04-22 08:20:59 UTC Canonical: https://phishdestroy.io/domain/ikraa.website/ ## VERDICT ---------------------------------------------------------------- STATUS STALE — last probed 15 days ago, treat as ACTIVE until re-verified Composite threat score: 51/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/95 security vendors flagged this domain Flagging vendors: SOCRadar AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist Victim re-reports (public form): 1 ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 89.117.24.25 (NL, Amsterdam) ASN: ASAS50673 Serverius Hosting org: AS50673 Serverius Registrar: Hosting Ukraine LLC Nameservers: ["ns119.inhostedns.com", "ns219.inhostedns.net", "ns319.inhostedns.org"] Registered: 2026-02-21 Expires: 2026-08-21 Page title: Welcome! ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-05-24 Status: INVALID chain Fingerprint: 314d070c131c0bfc212761c188176dddf198390063d95f08d3c3bba1875e2676 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-02-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-25 02:39:27 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-01-26 10:47:32 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-04-07 03:15:18 UTC (STALE — 15 days ago, re-verify) Flagged dead: 2026-03-16 12:04:19 UTC (NOT RE-VERIFIED IN 15 DAYS — treat as unconfirmed) Current status: UNCONFIRMED (our live-probe is 15 days stale) Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019bf943-da09-733f-b64d-7f02d3cad5e6/ URLQuery: https://urlquery.net/report/f9997a16-02cf-4ca0-a50c-25215f2eb187 Wayback Machine: https://web.archive.org/web/*/ikraa.website crt.sh CT logs: https://crt.sh/?q=%25.ikraa.website Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=ikraa.website AlienVault OTX: https://otx.alienvault.com/indicator/domain/ikraa.website URLhaus: https://urlhaus.abuse.ch/host/ikraa.website/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-03 03:37:20 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies ikraa.website as a domain linked to crypto drainer threats, aiming to stealthily extract cryptocurrency from victims. The site displays a generic "Welcome!" page but is involved in malicious activities targeting digital assets. The domain was registered through Hosting Ukraine LLC on 2026-02-21 and resolves to IP 89.117.24.25. It is currently active and appears on one security blocklist. AlienVault OTX associates it with one threat pulse, and VirusTotal flags it by one security vendor. Users should avoid visiting ikraa.website or interacting with any associated content. It is recommended to secure cryptocurrency wallets with strong authentication and monitor transactions for unauthorized activity. Report any suspicious behavior to cybersecurity authorities. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260126-C338FC Favicon MD5: 3f04c9ec4aa5bd9f8413b0bfbb0f9e1a TLS cert SHA-256: 314d070c131c0bfc212761c188176dddf198390063d95f08d3c3bba1875e2676 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/ikraa.website/ JSON API: https://api.destroy.tools/v1/check?domain=ikraa.website Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io