www-kra34at[.]cc

PhishDestroy identifies www-kra34at.cc as an active crypto drainer impersonating Kraken Exchange login pages. The domain employs a generic phishing kit designed to harvest credentials and cryptocurrency wallet seeds, redirecting victims to fraudulent withdrawal portals. This campaign targets users familiar with the Kraken platform, leveraging social engineering to trick victims into surrendering sensitive financial data. This domain was flagged by 6 out of 95 VirusTotal security vendors, indicating moderate detection rates despite its malicious nature. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.96.3. The domain holds a Google Trust Services SSL certificate, which may lend it an air of legitimacy. Notably, it was created on June 20, 2025, suggesting a recent and opportunistic campaign. While it does not yet appear on major blocklists, its low VT score and active status warrant immediate attention. As of this advisory, www-kra34at.cc remains active, with no evidence of takedown or mitigation. Users are strongly advised to block this domain at the network perimeter and update firewall rules to prevent access. The elevated risk stems from its recent creation, low blocklist presence, and SSL certification, which together increase the likelihood of successful phishing attempts. Immediate response actions include DNS sinkholing and endpoint protection updates. Remaining risk is elevated due to the domain’s active status and the absence of widespread blocking. Users should verify all Kraken-related URLs against official sources and enable multi-factor authentication to mitigate potential credential theft.