kra-20at[.]cc

PhishDestroy identifies kra-20at.cc as an active crypto drainer phishing domain posing as a legitimate service to steal cryptocurrency from unsuspecting users. This domain resolves to IP 104.21.14.218 and was registered on February 08, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain holds a valid SSL certificate issued by Google Trust Services, which may increase its credibility among potential victims. Evidence supporting this assessment includes its detection by 12 out of 95 security vendors on VirusTotal, indicating widespread suspicion of malicious activity. The recent creation date suggests this is a newly deployed campaign, likely targeting users through social engineering or deceptive links. The combination of a freshly registered domain, valid SSL, and immediate suspicious activity highlights the urgency of detection and mitigation. Users who visited this domain should immediately disconnect from the internet to prevent potential data or cryptocurrency theft. Scan all devices for malware or unauthorized transactions, especially wallet software. Report any suspicious activities to your cryptocurrency platform and update security measures, including enabling multi-factor authentication. If you suspect exposure to this campaign, verify the legitimacy of any further transactions or communications through official channels before proceeding.