kra35a[.]cc

PhishDestroy identifies kra35a.cc as a confirmed crypto drainer impersonating the Kraken cryptocurrency exchange. This fraudulent domain leverages brand impersonation to deceive victims into connecting their wallets and authorizing malicious token transfers. The site is part of a growing trend of crypto drainer kits designed to exploit user trust in established exchanges, with Kraken being a frequent target due to its global recognition and high user volume. This domain was flagged by 7 out of 95 VirusTotal security vendors, indicating elevated malicious activity. Technical indicators include registration through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolution to IP address 188.114.97.3, and an SSL certificate issued by Google Trust Services. The domain was created on April 10, 2025, suggesting a recent and rapidly deployed threat. While the domain is not currently flagged on Google Safe Browsing, its low VT detection ratio and active status pose significant risks to cryptocurrency users. As of the latest analysis, kra35a.cc remains active and poses an elevated risk to potential victims. PhishDestroy recommends immediate blocking of this domain at the network and endpoint levels. Users should verify the authenticity of any Kraken-related communications by cross-referencing official channels and avoiding any third-party links. The remaining risk is high due to the domain's recent creation, low initial detection rates, and the irreversible nature of cryptocurrency transactions. Continuous monitoring and proactive threat intelligence sharing are essential to mitigate further exploitation.