kra32-cc[.]com

PhishDestroy’s automated threat engine has flagged kra32-cc.com as an active crypto drainer domain designed to trick cryptocurrency users into approving malicious transactions that silently drain wallets. The domain mimics legitimate crypto services or exchanges to harvest seed phrases, private keys, or connection approvals, redirecting stolen funds to attacker-controlled addresses under the guise of “verification” or “security updates.” This domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on February 08, 2025, and currently resolves to IP address 188.114.97.3. According to VirusTotal, it is detected by 7 out of 95 participating security vendors, placing it in the elevated risk category. The SSL certificate is issued by Google Trust Services, which is leveraged to appear legitimate at first glance—an increasingly common tactic to evade browser warnings and gain user trust. If you visited kra32-cc.com, especially after being redirected or clicking an ad, immediately revoke any wallet connections using tools like WalletConnect or MetaMask’s “Connected Sites” list. Do not sign further transactions or enter seed phrases. Scan your device for malware using reputable antivirus software, rotate all wallet passwords, and consider transferring remaining funds to a newly created wallet with a different seed phrase. Report the domain to your wallet provider and local cybercrime units to help disrupt ongoing campaigns.