http-kra30[.]cc

http-kra30.cc is a recently activated crypto drainer phishing domain currently marked as active by PhishDestroy's threat intelligence platform. This domain mimics legitimate cryptocurrency platforms to deceive users into connecting wallets or entering credentials, resulting in direct fund theft. The subterfuge is designed to exploit trust in trusted brand names within the crypto ecosystem, particularly targeting users of major exchanges.

PhishDestroy identifies that http-kra30.cc was created on April 10, 2025, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to IP address 172.67.163.181 and has obtained an SSL certificate from Google Trust Services, which may lend a false sense of legitimacy. Critically, this domain has been flagged by 5 of 95 security vendors on VirusTotal, indicating emerging but confirmed malicious intent. Its recent creation and low blocklist count suggest it is a newly deployed threat designed to evade early detection.

Despite its adoption of HTTPS and issuance by a reputable certificate authority, the domain's low trust scores and minimal vendor recognition reflect high operational risk. Given its confirmed designation as a crypto drainer targeting Kraken users, experts strongly advise against any interaction with http-kra30.cc. Users are urged to verify links and domains using PhishDestroy before entering any credentials or connecting wallets. If exposure or suspicion occurs, disconnect devices from the internet, revoke connected permissions, and scan for malware using trusted antivirus tools.