app[.]kodlak[.]com

PhishDestroy identifies app.kodlak.com as an active crypto drainer domain flagged for generic phishing tactics targeting cryptocurrency users. The domain mimics a plausible service interface (app.kodlak.com) likely designed to deceive users into connecting wallets and authorizing unauthorized transactions. While no specific drainer kit fingerprint has been publicly disclosed, the structure and recent creation strongly suggest the use of evasive JavaScript-based drainers commonly deployed in such campaigns.

This domain was flagged with 5 out of 95 VirusTotal detections as of seed 1ed5c6, indicating low antivirus coverage despite behavioral anomalies. It was registered on December 07, 2024 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP 188.114.96.3. The domain holds a valid SSL certificate issued by Google Trust Services and has not yet been listed on Google Safe Browsing (GSB). Additional risk factors include its recent registration and high-risk hosting on Cloudflare infrastructure historically associated with phishing and malware campaigns.

As of current analysis, app.kodlak.com remains active and under investigation with a status of 'active'. Users are advised not to interact with this domain or input any credentials or wallet connections. Security teams should block the domain at the network level and monitor for related infrastructure. Remaining risk is assessed as medium due to undetected status on key threat intelligence platforms, but the domain exhibits multiple hallmarks of a coordinated crypto drainer campaign. Immediate takedown or blocklisting is recommended to prevent financial loss.