kpa39[.]cc

PhishDestroy identifies kpa39.cc as an active crypto drainer domain impersonating cryptocurrency platforms. This domain is currently engaged in threat operations and presents an elevated risk to users engaged in crypto transactions. The infrastructure is designed to deceive victims into transferring funds to fraudulent addresses under the guise of trustworthy services. Immediate intervention is advised to prevent financial compromise.

This domain was flagged by six of ninety-five VirusTotal security vendors, indicating significant but not universal detection coverage. Registrar records obtained via WHOIS lists NICENIC INTERNATIONAL GROUP CO., LIMITED as the domain host. kpa39.cc resolves to IP address 188.114.96.3 and holds a valid SSL certificate issued by Google Trust Services, which may mislead users into believing the site is legitimate. The domain was created on February 07, 2025, suggesting a recent deployment consistent with opportunistic fraud targeting emerging or seasonal crypto trends.

Given the domain’s active status and association with crypto drainer activity, PhishDestroy recommends immediate network-level blocking of kpa39.cc and associated IP 188.114.96.3. Users should avoid any transactional or login interactions with this domain. Organizations are advised to update firewall rules, DNS sinkholes, and endpoint protection lists. Employees and customers should be notified of this threat via official communication channels. Continuous monitoring of emerging domains with similar registration patterns is strongly encouraged to mitigate further exposure.