kra-35[.]cc

PhishDestroy has identified kra-35.cc as an active crypto drainer impersonating the Kraken Exchange platform. This domain is designed to trick users into connecting compromised cryptocurrency wallets, enabling unauthorized transfers of digital assets without consent. Security teams observed that kra-35.cc resolves to IP address 188.114.97.3 and is flagged by 8 out of 95 VirusTotal security vendors, indicating elevated risk. The domain was registered on November 06, 2024 through NICENIC INTERNATIONAL GROUP CO., LIMITED and holds a valid SSL certificate issued by Google Trust Services.

This domain was flagged as a threat based on multiple indicators of malicious intent. VirusTotal shows 8/95 vendors flagging kra-35.cc, suggesting substantial but not universal detection. The registrar, NICENIC INTERNATIONAL GROUP CO., LIMITED, has been associated with numerous low-cost, high-risk domain registrations. Creation date analysis indicates this domain was registered very recently, aligning with active phishing campaigns targeting cryptocurrency users. The presence of a valid SSL certificate may enhance the appearance of legitimacy, deceiving users who rely on HTTPS indicators.

If you visited kra-35.cc or entered any information, immediately disconnect any connected wallets and revoke permissions through your wallet provider’s interface. Do not interact further with this domain or any linked pages. Report the domain to your IT security team and consider blocking it at the network level. Monitor wallet transactions closely for unauthorized activity and update your threat intelligence feeds with this indicator. Users should rely on verified domain sources and enable multi-factor authentication on all cryptocurrency platforms.