kra12at[.]cc

The domain kra12at.cc was identified as a generic phishing threat, specifically operating as a crypto drainer designed to steal cryptocurrency wallet credentials and funds. This type of phishing site typically mimics legitimate cryptocurrency platforms or exchanges, tricking users into connecting their wallets or entering private keys. Once a user interacts with the site, malicious scripts drain assets from the connected wallet. The domain has since been taken offline, but users who visited it may still be at risk.

Evidence from security scans underscores the threat. VirusTotal analysis shows that 13 out of 95 security vendors flagged the domain as malicious, indicating broad detection across the security community. The domain was created on March 28, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 95.85.236.107 and appears on one security blocklist. AlienVault OTX also reported the domain in one threat intelligence pulse, linking it to known phishing campaigns. Notably, the domain lacks an SSL certificate, which is a common red flag for phishing sites.

Users who visited kra12at.cc should take immediate action to protect their assets. First, revoke any permissions granted to the site from cryptocurrency wallets. Change passwords for any accounts that may have been compromised, and enable two-factor authentication where possible. Monitor wallet addresses for unauthorized transactions and consider transferring funds to a new, secure wallet. PhishDestroy recommends verifying any suspicious domains through its platform before interacting with them, and staying informed about emerging phishing threats to avoid future attacks.