case-battle[.]kz

PhishDestroy identifies case-battle.kz as a live crypto drainer phishing domain under active red-team investigation. This domain is engineered to masquerade as a legitimate crypto-related portal, leveraging a drainer kit to siphon funds from unsuspecting victims’ wallets. The infrastructure is provisioned for high-yield credential and token theft, with domain registration obfuscation techniques suggesting intent to persist undetected. Behavioural telemetry indicates redirection to fake wallet interfaces upon interaction, capturing private keys and transaction approvals.

This domain was flagged during routine scan f65e04 on 2024-06-12T14:32:00Z. Technical indicators include resolution to AS13335 Cloudflare (IP 172.67.144.208), Google Trust Services SSL certificate (CN *.case-battle.kz), and 1 out of 95 VirusTotal detections at time of analysis. Domain was registered on 2024-05-15 via Namecheap Inc., with a creation timestamp of 2024-05-15T00:00:00Z. It currently remains unlisted on Google Safe Browsing (GSB) and is not present on any major public blocklists as of 2024-06-12.

The domain is categorized as ACTIVE with risk level UNDER_INVESTIGATION. PhishDestroy has flagged this domain to all participating browser and security vendors for immediate takedown coordination. While cloud-hosted infrastructure may complicate remediation, retroactive analysis shows zero detections on VirusTotal, underscoring the need for proactive monitoring. Users are advised to avoid interacting with case-battle.kz and to verify unknown links via PhishDestroy’s real-time lookup tool. Remaining risk is assessed as HIGH due to active deployment and absence of vendor detection. PhishDestroy continues to monitor this domain and will escalate findings to CERT teams if persistence is observed.