krekan[.]wixstudio[.]com

The domain krekan.wixstudio.com has been identified as a crypto drainer phishing site, designed to extract cryptocurrency wallet credentials and drain funds from victims. Analysis indicates this domain is currently offline, though it previously hosted active malicious infrastructure targeting users of decentralized finance platforms. No specific brand impersonation has been confirmed, but the site employed typical crypto wallet interface spoofing techniques to deceive users into entering private keys or seed phrases. Infrastructure analysis reveals the domain resolved to IP address 34.144.206.118 and was registered through GoDaddy.com, LLC on April 07, 2026. It is flagged by 9 of 95 security vendors on VirusTotal, with detections from multiple threat intelligence feeds. The domain appears on three security blocklists and was proactively blocked by wallet security providers and phishing detection systems. A Let's Encrypt SSL certificate was deployed, likely to lend a false sense of legitimacy to the malicious endpoint. The creation date suggests recent registration, aligning with common phishing domain lifecycle patterns. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and associated IP at network and endpoint levels. Users should verify wallet addresses and transaction details via trusted interfaces only, avoiding links from unsolicited communications. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure. If wallet credentials were entered on this site, immediate revocation of compromised keys and fund transfers to secure wallets are strongly recommended.