krkmp[.]cc

PhishDestroy identifies krkmp.cc as an active generic phishing domain hosting an InfoStealer drainer kit designed to harvest sensitive credentials and cryptocurrency wallet data. The landing page on this domain mimics kdmp2.cc, a known drainer kit front-end, indicating that attackers are leveraging established phishing frameworks to maximize their success rate. This domain was registered on October 23, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, suggesting a recent campaign targeting unsuspecting victims. This domain resolves to the IP address 172.67.205.90 and is secured by an SSL certificate issued by Google Trust Services, which may lull users into a false sense of security. VirusTotal’s assessment shows that 4 out of 95 security vendors have flagged krkmp.cc, a relatively low detection rate that highlights the sophistication of the threat actors in evading traditional security measures. The domain’s recent creation date and the use of a legitimate-looking SSL certificate underscore the importance of proactive threat intelligence and domain monitoring. At present, krkmp.cc remains active and poses an elevated risk to users who may inadvertently interact with the domain. Immediate actions include blocking both the domain and the associated IP address at the network perimeter to prevent access. Security teams should update firewall rules, DNS sinkholes, and proxy filters to ensure comprehensive coverage. While the current detection rate is low, the domain’s active status and the use of a drainer kit indicate a high potential for successful compromise. Remaining risk is elevated, particularly for users in environments where such domains are not proactively blocked, necessitating continuous monitoring and rapid response to mitigate potential breaches.