kra-6at[.]com

This domain, kra-6at.com, is confirmed to operate as a fake cryptocurrency wallet credential harvester. Analysis indicates the site impersonates legitimate wallet login portals to capture sensitive user credentials, including private keys and recovery phrases. The threat is designed to facilitate unauthorized access to cryptocurrency holdings, leading to potential asset drainage or account takeover. Infrastructure and behavioral patterns align with known crypto drainer campaigns, where victims are lured through phishing links distributed via email, social media, or malicious advertisements. Evidence supporting this assessment includes detection by 16 out of 95 security vendors on VirusTotal, registration through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 28, 2026, and resolution to the IP address 95.85.236.107, hosted by MHost LLC in Germany. The domain appears on one security blocklist and was previously blocked by enterprise phishing detection systems. Notably, the absence of an SSL certificate further reduces legitimacy, as secure connections are standard for financial services. The creation date suggests recent deployment, typical of short-lived phishing domains designed to evade detection. Users who visited kra-6at.com or entered credentials on the site should assume compromise. Immediate actions include revoking access to any linked cryptocurrency wallets, generating new private keys, and enabling multi-factor authentication on all associated accounts. Monitor financial transactions for unauthorized activity and report the incident to relevant blockchain security teams. If browser sessions were active, clear cached data and reset passwords for all sensitive accounts. Avoid interacting with unsolicited links or pop-ups, and verify domain authenticity before entering credentials on any financial platform.