kra23a[.]cc

PhishDestroy identifies kra23a.cc as an active crypto drainer domain designed to steal cryptocurrency wallet credentials and assets. This domain mimics legitimate exchange services to trick users into connecting wallets or entering private keys. The infrastructure is engineered to drain funds immediately upon interaction, posing a severe financial risk to cryptocurrency holders. kra23a.cc resolves to IP 188.114.97.3 and leverages a Google Trust Services SSL certificate to appear legitimate. It was registered on April 04, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for anonymity-friendly registrations that often facilitate malicious activity. This domain exhibits multiple red flags indicative of malicious intent. VirusTotal analysis confirms 9 out of 95 security vendors flag kra23a.cc as malicious, with additional detection by PhishDestroy’s blocklist, bringing the total to two independent blocklist hits. The domain’s recent creation date—just days ago—suggests a hastily deployed campaign, likely part of a broader wave targeting crypto users during high-activity periods. The combination of a newly registered domain, low detection latency by key vendors, and the use of a trusted SSL issuer demonstrates an advanced evasion strategy aimed at bypassing traditional security measures. Users who have visited kra23a.cc should immediately disconnect any connected cryptocurrency wallets, revoke any permissions granted to suspicious domains, and transfer funds to cold storage if necessary. Run a full antivirus scan and review browser extensions for unauthorized access. Report the domain to your security provider and consider enabling hardware wallet authentication for all transactions. Monitor wallet activity closely for unauthorized transfers. Never enter private keys or wallet seeds on any website—legitimate services will never request this information.