kong-defi[.]com

This domain is flagged as an active crypto drainer, a threat type designed to siphon cryptocurrency assets from victim wallets through malicious JavaScript injections or fake DeFi interfaces. The elevated risk level is assigned due to confirmed malicious behavior, including unauthorized transaction signing and wallet credential harvesting, which can lead to immediate financial loss without user awareness. Analysis indicates the domain kong-defi.com was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which has been observed in prior cryptocurrency-related fraud campaigns. VirusTotal reports 2 out of 95 security vendors flagging this domain as malicious, a low but non-zero detection rate that suggests emerging or evasive threats. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy while the domain remains unlisted on major blocklists, likely due to its recent creation and targeted distribution. Mitigation requires immediate action from both end users and network defenders. Users should block the domain kong-defi.com at the DNS or browser level and verify all DeFi interactions through official, verified platforms. Wallet extensions should be audited for unauthorized permissions, and hardware wallets should be used for high-value transactions to prevent script-based attacks. Organizations should monitor network traffic for connections to 188.114.97.3 and alert on any attempts to access the domain, particularly in environments handling cryptocurrency or financial data. Proactive threat hunting for related indicators, such as anomalous JavaScript loads or unexpected wallet connection prompts, is recommended to detect and disrupt this drainer infrastructure.