karaken-logn[.]wixstudio[.]com

karaken-logn.wixstudio.com is a cryptocurrency drainer domain flagged during a routine SOC investigation. The domain mimics legitimate crypto-related services to trick users into connecting their wallets, enabling unauthorized fund transfers. No specific brand or drainer kit was identified during initial analysis, but the domain’s infrastructure aligns with common phishing-as-a-service (PhaaS) toolkits targeting Web3 users.

This domain resolves to IP 34.144.206.118 and utilizes a Let’s Encrypt SSL certificate for legitimacy obfuscation. VirusTotal analysis shows 0 detections out of 95 engines, suggesting low signature recognition despite its malicious activity. The domain was created on an unspecified date (prior to detection) and is registered through an unknown registrar. It currently appears on 2 security blocklists, including MetaMask and SEAL, but remains active. Google Safe Browsing (GSB) status is unconfirmed, though its presence on multiple blocklists indicates elevated risk.

As of this advisory, karaken-logn.wixstudio.com remains active, posing an ongoing threat to cryptocurrency users. Immediate blocklisting is recommended across security stacks, and users should exercise extreme caution when encountering crypto-related domains hosted on Wix or similar platforms. While current detections are minimal, the domain’s operational status and blocklist presence warrant proactive mitigation. Remaining risk is classified as under investigation, with further IOC expansion likely as analysis continues.