kratg[.]top

PhishDestroy identifies kratg.top as an active cryptocurrency drainer domain, leveraging social engineering to trick users into connecting fraudulent wallet services. While no specific brand or drainer kit was detected in this sample, the site’s structure and intent align with common crypto scam tactics. The domain’s recent creation—just weeks ahead of the current date—suggests opportunistic registration, likely targeting unsuspecting users during peak transaction periods. This domain resolves to IP address 188.114.97.3 and is associated with a Google Trust Services SSL certificate, potentially lending false legitimacy. VirusTotal analysis confirms detection by only 1 out of 95 security vendors, highlighting its stealthy nature, while registration through Spaceship, Inc. and a creation date of May 03, 2026—an anomaly given today’s date—further expose its deceptive setup. No presence on Google Safe Browsing lists or other blocklists was observed, emphasizing the need for proactive defenses. Currently active and unblocked, kratg.top remains a viable threat to cryptocurrency users. Immediate action includes adding the domain and IP to network blocklists, flagging the certificate, and advising users to avoid unsolicited wallet connections. Remaining risk is elevated due to low vendor detection and plausible deniability via trusted services, warranting heightened vigilance.