kar28[.]cc

The domain kar28.cc has been flagged as an active crypto drainer phishing page, designed to steal cryptocurrency from unsuspecting users. This threat involves a generic drainer kit deployed on the domain, with no specific brand impersonation detected at this time. The infrastructure appears to be freshly provisioned and is currently operational, posing an elevated risk to potential victims interacting with the site.

PhishDestroy’s forensic analysis reveals the following technical indicators: VirusTotal reports a detection score of 5 out of 95 security vendors, indicating limited but notable coverage. The domain was registered on December 16, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 86.54.25.38. At the time of analysis, the domain remains unblocked in Google Safe Browsing (GSB) and has not yet been added to major threat intelligence blocklists, leaving a window of exposure for users.

As of the latest assessment, kar28.cc is classified as an active threat with an elevated risk level. Immediate response actions include blocking the domain at the network perimeter and updating endpoint protections to detect access to this URL. Users are strongly advised to avoid interacting with the domain and to verify its safety status on PhishDestroy before proceeding. While the current risk is elevated due to the domain’s recent registration and low blocklist presence, ongoing monitoring and proactive threat hunting will be critical to mitigating further exposure.