kra-30-cc[.]com

This domain is flagged as a high-risk crypto drainer phishing site designed to compromise cryptocurrency wallet credentials. Analysis indicates the infrastructure was specifically engineered to deceive users into authorizing malicious transactions, despite presenting a generic 404 error page. The domain’s intent remains clear through its technical indicators and historical behavior. Infrastructure analysis reveals kra-30-cc.com was registered through NiceNIC International Group Co., Limited, resolving to IP address 104.21.66.253. The domain was created on February 25, 2026, an anomalous date suggesting potential domain spoofing or backdating. It appears on three security blocklists and is blocked by MetaMask, PhishDestroy, and SEAL. The domain holds a Gridinsoft trust score of 0/100, with 13 out of 95 security vendors on VirusTotal flagging it as malicious. Detected technologies include Cloudflare and HTTP/3, while the SSL certificate is issued by Google Trust Services, a common obfuscation tactic in phishing campaigns. Mitigation steps for this crypto drainer threat include immediate blocking of the domain and its associated IP at the network level. Users should revoke any suspicious wallet authorizations linked to kra-30-cc.com and verify transaction histories for unauthorized activity. Security teams should monitor for related domains using the same registrar or IP range, as these may indicate follow-up campaigns. Wallet providers and exchanges should preemptively warn users about this domain and enforce strict transaction validation protocols to prevent asset loss.