krafton-official[.]eventsredeems[.]com

This domain, krafton-official.eventsredeems.com, is identified as a credential theft operation designed to impersonate Krafton, a well-known gaming company. Analysis indicates the site likely deployed fake login portals or account verification pages to harvest user credentials, a common tactic in targeted phishing campaigns. The domain exhibits no direct ties to cryptocurrency drainer kits, focusing instead on traditional credential theft through brand impersonation. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 02, 2025, through Aceville Pte. Ltd., and resolves to the IP address 172.67.201.60, hosted on Cloudflare’s network (AS13335). It is flagged by 15 out of 95 security vendors on VirusTotal, appears on two security blocklists (PhishDestroy and PhishingDB), and lacks an SSL certificate. Additionally, the page title, 'Edge IP Restricted | krafton-official.eventsredeems.com | Cloudflare,' suggests an attempt to mimic Cloudflare’s security features while restricting direct access. Currently, the domain is offline, reducing immediate risk to users. However, the infrastructure remains registered, and similar domains may resurface under different names. The registrar and hosting provider have not publicly disclosed takedown actions, leaving the possibility of reactivation. Users are advised to verify domain authenticity before entering credentials, monitor for unusual account activity, and report any suspicious login attempts to the legitimate brand’s security team.