www-kra32at[.]com

PhishDestroy flagged www-kra32at.com as a generic phishing domain leveraging cryptocurrency drainer tactics, posing a high risk to users handling digital assets. The domain mimics legitimate services to trick victims into approving malicious transactions or revealing wallet credentials. No specific brand impersonation or drainer kit was identified in the initial analysis, but behavioral patterns align with wallet-draining malware observed in similar campaigns (seed 3a1bc7).

This domain exhibits multiple red flags confirmed by forensic data: VirusTotal scored it 7/95 detections at the time of analysis, indicating evasion of common antivirus engines. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 20, 2025, the site operates from IP 104.21.36.224 and holds a valid SSL certificate from Google Trust Services, which attackers often exploit to appear legitimate. Notably, it remains unblocked by Google Safe Browsing (GSB) and shows no presence on major threat intelligence blocklists as of the investigation.

As of the latest assessment, www-kra32at.com remains active with an 'under_investigation' status, suggesting ongoing scrutiny without definitive remediation. Users are advised to block the IP 104.21.36.224 at the network level and avoid interacting with any links or prompts from this domain. The remaining risk is classified as elevated due to the domain's recent registration, lack of detections, and potential for rapid takedown evasion. PhishDestroy recommends treating all crypto-related communications from unknown domains as hostile until proven otherwise.