kpk[.]capital

This domain is flagged as an elevated-risk crypto drainer phishing operation targeting onchain asset management users. Analysis indicates the site was designed to mimic legitimate decentralized finance platforms, likely to execute unauthorized transactions or drain cryptocurrency wallets upon interaction. The specific threat type—crypto drainer—is characterized by its focus on extracting digital assets through deceptive smart contract interactions or wallet connection prompts, a growing vector in financial fraud. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain kpk.capital was registered on October 30, 2024, through HOSTINGER operations, UAB, a registrar frequently associated with short-lived phishing domains. It resolves to the IP address 188.114.96.3, which has been linked to other malicious infrastructure in recent threat intelligence reports. Security vendors on VirusTotal flagged the domain at a 4/95 detection rate, while it appears on three distinct security blocklists, including those maintained by browser extensions and enterprise security platforms. AlienVault OTX records the domain in two threat intelligence pulses, further corroborating its malicious classification. The page title, 'KPK | Scalable onchain asset management,' aligns with common phishing tactics that leverage cryptocurrency-related terminology to establish false credibility. Mitigation steps for this threat type require immediate action from both end users and security teams. Users who interacted with kpk.capital should revoke any connected wallet permissions via blockchain explorers or dedicated revocation tools, as crypto drainers often exploit lingering smart contract authorizations. Wallet addresses associated with the domain should be treated as compromised and added to internal blocklists. Organizations should update firewall rules to block the domain and its resolving IP (188.114.96.3) at the network perimeter. Given the domain's recent creation date and registrar history, security teams should monitor for newly registered domains under the same registrar or IP range, as threat actors frequently rotate infrastructure. For users, verifying domain authenticity through official project documentation or community channels remains critical to avoiding similar phishing schemes.