kra-48at[.]cc

PhishDestroy identifies kra-48at.cc as an active crypto drainer domain currently leveraging brand impersonation tactics to deceive users. This malicious endpoint has been categorized under generic phishing due to its active involvement in cryptocurrency theft schemes, specifically designed to mimic legitimate services and lure victims into connecting wallets. The domain is currently live and poses an elevated risk to unsuspecting users engaging with its fraudulent interfaces. This domain resolves to IP address 185.226.92.168 and was registered on November 19, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal analysis reveals that 10 out of 95 security vendors have flagged this domain as malicious, indicating a moderate level of detection across the cybersecurity community. The domain utilizes a Let's Encrypt SSL certificate, potentially enhancing its credibility to bypass user skepticism. Additional indicators such as its recent creation date and association with known malicious infrastructure further solidify its threat profile. Given the elevated risk posed by kra-48at.cc, users are strongly advised to avoid accessing this domain under any circumstances. Organizations should update their threat intelligence feeds, firewall rules, and browser blocklists to include this domain and its associated IP address. Immediate verification using PhishDestroy’s tools is recommended for any recent interactions with this domain. Security teams should conduct retrospective analysis of network logs to identify potential compromise and disseminate this advisory to stakeholders to prevent further exposure.