home-kraknapps[.]wixstudio[.]com

This domain, home-kraknapps.wixstudio.com, is flagged as a Web3 credential harvesting site designed to mimic legitimate cryptocurrency wallet interfaces. Analysis indicates the infrastructure was engineered to deceive users into entering private keys or recovery phrases, enabling unauthorized access to digital assets. The threat specifically targets decentralized finance (DeFi) users, leveraging social engineering tactics to prompt urgent or misleading transaction approvals, which can result in immediate fund drainage from compromised wallets. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain has been detected by 6 out of 95 security vendors on VirusTotal, a notably elevated detection rate for a phishing resource. It is registered through GoDaddy.com, LLC, with a creation date of December 17, 2016, suggesting an established presence that may have been repurposed for malicious activity. The domain appears on five distinct security blocklists, including those maintained by Web3 security platforms, and resolves to the IP address 34.144.206.118. The SSL certificate, issued by Let’s Encrypt, provides basic encryption but does not validate the legitimacy of the site’s content or intent. Users who interacted with this domain should take immediate remedial action. Any credentials, recovery phrases, or private keys entered on this site must be considered compromised. Affected individuals should transfer remaining assets to a new, secure wallet using a clean device and revoke all active session approvals associated with the compromised wallet. It is recommended to monitor transaction histories for unauthorized activity and enable multi-factor authentication where available. Additionally, users should scan their devices for malware, as phishing sites may deploy secondary payloads to maintain persistence or exfiltrate additional data.