kra135[.]cc

PhishDestroy identifies kra135.cc as an active cryptocurrency drainer domain operating under an elevated threat classification. This domain was flagged for generic phishing activities targeting cryptocurrency users, utilizing social engineering tactics to deceive victims into connecting their wallets or entering credentials. The domain’s infrastructure aligns with known drainer kit behaviors, where attackers drain funds from victims' wallets post-credential harvesting or wallet signature approvals. While no specific drainer kit name is associated with this domain in current threat intelligence, the operational patterns closely resemble those observed in cryptocurrency theft campaigns leveraging fake wallet connection portals or fraudulent transaction approvals.

This domain was registered on March 28, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, with hosting resolved to IP address 104.21.25.223. Google Safe Browsing (GSB) does not currently flag this domain, but VirusTotal reports a detection ratio of 15 out of 95 security vendors, indicating partial coverage against this threat. The domain utilizes a Google Trust Services SSL certificate, suggesting attackers are leveraging trusted certificate authorities to enhance credibility and evade basic browser security indicators. Current blocklist coverage is limited, with no presence in major threat intelligence feeds beyond VirusTotal’s partial detection.

kra135.cc remains active as of the latest assessment, with no indication of takedown or remediation by hosting providers. Immediate actions for security teams and users include blocking this domain at DNS and network levels, flagging the associated IP (104.21.25.223), and disseminating user advisories to avoid interactions. The elevated risk profile of this domain stems from its cryptocurrency targeting nature and the potential for rapid fund depletion upon user engagement. While partial detection exists, the absence of widespread blocklisting and the use of a trusted SSL certificate elevate the urgency for proactive defense measures to mitigate successful exploitation. Remaining risk is categorized as elevated due to the domain's active status and the sophistication of its operational infrastructure.