2krn[.]vip

PhishDestroy identifies the domain 2krn.vip as an active crypto drainer impersonating login pages to harvest cryptocurrency wallet credentials. The domain is currently classified under an elevated risk level and remains operational as of the latest analysis. This threat specifically targets users through deceptive login interfaces designed to mimic legitimate cryptocurrency platforms, enabling attackers to drain digital assets from compromised wallets. Security teams and end-users are strongly advised to exercise caution when encountering this domain or any associated URLs, as interactions may result in irreversible financial losses. This domain, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 16, 2025, resolves to the IP address 172.67.144.26 and utilizes an SSL certificate issued by Google Trust Services. PhishDestroy's analysis reveals that 1 of 95 VirusTotal security vendors flag this domain, indicating limited but present detection across public threat intelligence platforms. The domain's recent registration date and its association with a generic top-level domain (.vip) raise concerns about its potential for misuse in phishing campaigns targeting cryptocurrency users. While the domain itself has low detection rates, its combination of a recently registered domain, specific infrastructure choices, and SSL certificate usage suggests a sophisticated attempt to evade automated detection mechanisms. As of the latest assessment, 2krn.vip remains active and poses an ongoing threat to cryptocurrency users. Users who may have already interacted with this domain are advised to immediately revoke any permissions granted to associated wallets and transfer remaining assets to newly generated addresses. Organizations are urged to update their threat intelligence feeds with this domain and its IP address to prevent further exposure. PhishDestroy recommends verifying all cryptocurrency-related URLs through its platform before entering sensitive information. Additionally, enabling multi-factor authentication (MFA) on all wallet accounts and using hardware wallets for large transactions can significantly mitigate the risk of credential theft and financial loss. Users should also report any suspicious activity to their respective cryptocurrency platforms and local cybersecurity authorities to aid in the disruption of these threat actors.