kra32-at[.]cc

PhishDestroy identifies kra32-at.cc as an active crypto drainer domain propagating credential theft under the guise of Kraken cryptocurrency services. This domain has been classified as elevated risk due to confirmed malicious infrastructure tied to unauthorized fund extraction campaigns targeting unsuspecting users. Kra32-at.cc was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on November 06, 2024, shortly before the onset of observed malicious activity. This domain resolves to IP address 172.67.134.61 and operates with an SSL certificate issued by Google Trust Services, which enhances its disguise as a legitimate service. According to VirusTotal analysis, 5 out of 95 security vendors currently flag kra32-at.cc as malicious, indicating active detection by reputable threat intelligence systems. The domain's recent creation—within the past month—suggests a campaign designed for rapid deployment and evasion of historical blocklists. Users are strongly advised to avoid visiting kra32-at.cc and report this domain immediately to their security teams or via abuse channels. Organizations should implement DNS filtering rules to block resolution of this domain. Cybersecurity teams should inspect network traffic for communications with 172.67.134.61 and monitor endpoints for unauthorized cryptocurrency wallet activity. Additionally, users who entered credentials or crypto wallet seeds on this domain should revoke access to compromised accounts and transfer remaining assets to new, secure wallets. Immediate action is crucial to prevent financial loss.