kra30-cc[.]net

The domain kra30-cc.net has been confirmed as an active crypto drainer scam leveraging deceptive tactics to siphon cryptocurrency from unsuspecting victims. This threat involves malicious scripts embedded in spoofed web interfaces designed to drain digital asset wallets upon interaction. The elevated risk level reflects the immediate danger posed to users who may inadvertently connect their wallets or enter sensitive information. PhishDestroy identifies kra30-cc.net as a malicious domain with multiple red flags: it is flagged by only 3 out of 95 VirusTotal security vendors, indicating low detection coverage despite its active status. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on February 08, 2025, and resolves to the IP address 188.114.96.3. Notably, the domain holds a Google Trust Services SSL certificate, which may lull victims into a false sense of security by appearing legitimate. The low detection rate on VirusTotal suggests this scam is either newly deployed or deliberately evading traditional security measures, making it particularly dangerous for early victims. This threat requires immediate action to prevent financial loss. Users should avoid interacting with kra30-cc.net entirely and report the domain to their cybersecurity teams or trusted threat intelligence platforms. If wallet connections or sensitive inputs were made, users must revoke permissions, transfer remaining assets to a new wallet, and scan devices for malware. Organizations should block the domain and IP at the network level to prevent further compromise. Crypto drainer scams like this often evolve quickly, so continuous monitoring and sharing of IOCs (Indicators of Compromise) with the security community is critical to mitigate ongoing risks.