kra3-at[.]cc

PhishDestroy identifies kra3-at.cc as an elevated-risk crypto drainer domain designed to steal cryptocurrency assets through fraudulent transactions. This site impersonates legitimate blockchain or wallet interfaces to trick users into authorizing unauthorized transfers. The threat is active and leverages social engineering to exploit victims' trust in familiar crypto platforms.

This domain was flagged with 9 out of 95 VirusTotal security vendors detecting malicious activity, indicating significant—but not universal—consensus on its harmful nature. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 04, 2025, kra3-at.cc resolves to IP 104.21.89.89 and holds a Google Trust Services SSL certificate to appear legitimate. Blocked by PhishDestroy and listed on one additional security blocklist, the domain’s recent creation aligns with opportunistic threat actor behavior targeting unsuspecting crypto users.

To mitigate risk, users must immediately block kra3-at.cc and avoid interacting with any links or pop-ups associated with this domain. Verify website URLs manually before entering sensitive information or approving transactions. Report encounters to PhishDestroy and local cybersecurity authorities to disrupt ongoing campaigns. Organizations should deploy DNS filtering to prevent internal access to this domain.