kra42-at[.]com

PhishDestroy identifies kra44-at.com as a high-elevation crypto drainer site detected on February 7, 2025. The domain masquerades as the Kraken exchange portal, luring users into connecting wallets and approving malicious transactions that drain crypto holdings. Security telemetry confirms active phishing infrastructure designed to harvest private keys and sign unauthorized blockchain transactions, indicating a clear theft-of-funds objective. This domain was flagged by 3 out of 95 VirusTotal security vendors at initial scan time, with a further detection ratio that has since expanded. The SSL certificate is issued by Google Trust Services, lending false legitimacy, while the backend resolves to IP 104.21.89.240. Registration occurred through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar associated with high volumes of abusive domains. The domain was created on February 7, 2025, fewer than 48 hours prior to detection, indicating a fresh and rapidly deployed threat campaign. Despite the short age, kra42-at.com already triggers multiple global blocklists, signalling widespread recognition as a malicious endpoint. As of the most recent telemetry pull, the site remains active and unresolved, propagating via social engineering vectors and phishing-as-a-service channels. Immediate network-wide blocks are recommended, alongside wallet-level warnings for users who may have already interacted with the domain. While takedown requests have been initiated with the hosting provider and registrar, the elevated risk persists due to the domain’s recent registration and the use of a trusted SSL certificate. Users are strongly advised to verify all Kraken-related links using PhishDestroy prior to credential entry or wallet connection, and to revoke any malicious approvals via blockchain explorers immediately.