kras4[.]cc

This domain, kras4.cc, is flagged as a high-risk cryptocurrency phishing site specifically designed to impersonate Kraken, a well-known cryptocurrency exchange platform. Analysis indicates the site employs brand impersonation tactics to deceive users into divulging sensitive credentials, likely including wallet private keys or login details, which could lead to unauthorized asset transfers. The page title explicitly mimics the legitimate Kraken platform, reinforcing the fraudulent scheme. No specific drainer kit signatures were identified in initial scans, though the infrastructure aligns with known phishing campaigns targeting cryptocurrency users. Infrastructure analysis reveals critical technical indicators associated with this domain. The domain was registered on January 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently linked to malicious domains. It resolves to the IP address 188.114.97.3, which is associated with Cloudflare services, a common obfuscation tactic to mask the true hosting origin. Security vendor detections on VirusTotal stand at 15 out of 95, indicating moderate but consistent flagging across threat intelligence platforms. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and holds a Gridinsoft trust score of 0/100, reflecting its confirmed malicious status. Technologies detected include Cloudflare and HTTP/3, further suggesting efforts to evade detection and enhance site performance for fraudulent purposes. As of the latest assessment, kras4.cc has been taken offline, likely due to coordinated takedown efforts or registrar intervention. However, the domain remains a verified threat due to its recent creation date and persistent blocklist presence. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. The remaining risk stems from potential re-registration or migration of the phishing infrastructure to alternative domains, necessitating continued vigilance and proactive blocking of related indicators of compromise.