at-krab2[.]cc

PhishDestroy identifies at-krab2.cc as an active crypto drainer impersonating a popular gaming brand, designed to trick users into connecting fraudulent cryptocurrency wallets. This domain was flagged by 5 out of 95 security vendors on VirusTotal, indicating a moderate but credible risk of financial theft through unauthorized wallet drainers. The domain resolves to IP address 188.114.96.3 and was registered on December 11, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED using a Google Trust Services SSL certificate, which adds a false sense of legitimacy. The technical indicators and timing of this domain raise red flags for immediate scrutiny. The domain is extremely new, created in December 2025—suggesting it was registered specifically for malicious purposes. The low but concerning detection rate on VirusTotal (5/95) suggests some security systems may not yet recognize its malicious infrastructure. The SSL certificate from Google Trust Services is commonly leveraged in phishing campaigns to bypass browser warnings and deceive users into trusting the site. Combined with the rapid registration timeline, this suggests an opportunistic campaign likely targeting users actively engaging with gaming or crypto-related content. If you visited at-krab2.cc, especially if you connected a cryptocurrency wallet or entered login credentials, disconnect your wallet immediately and revoke any suspicious permissions. Do not enter personal or financial information. Scan your device with updated anti-malware software. Visit PhishDestroy to verify the legitimacy of similar domains and report this unsafe site. Proactive verification and use of security tools are critical to prevent unauthorized access and crypto asset loss.