kra--31--at[.]top

This domain, kra--31--at.top, operates as a credential harvesting platform targeting cryptocurrency wallet users. Analysis indicates the infrastructure is designed to mimic legitimate wallet login interfaces, tricking victims into submitting private keys or recovery phrases. The threat type is classified as generic phishing with a focus on crypto asset theft, a method commonly used to drain funds from unsuspecting users once credentials are captured. No specific brand impersonation has been confirmed, but the domain structure suggests an attempt to resemble known crypto service URLs through obfuscation techniques. Evidence supporting the malicious classification includes detection by 10 out of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. Infrastructure analysis reveals registration through 耐思尼克国际集团有限公司, a registrar frequently associated with high-risk domains. The domain was created on March 29, 2026, indicating a recently established threat vector with no legitimate historical use. Current status shows the domain has been taken offline, though this does not eliminate the risk of reactivation or migration to similar infrastructure. Users who accessed kra--31--at.top should assume credential compromise and take immediate action. First, revoke any active sessions or authorizations linked to cryptocurrency wallets or exchanges. Second, transfer assets to a new wallet with a fresh seed phrase, as stored credentials may be exfiltrated. Third, monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. If private keys or recovery phrases were entered, consider the original wallet permanently compromised. Security teams should update blocklists to include this domain and monitor for related infrastructure using the registrar or naming patterns.