kkra30at[.]ru

The domain kkra30at.ru is identified as a high-risk crypto drainer phishing site designed to extract cryptocurrency wallet credentials and drain funds from victims. As of the latest verification, the domain has been taken offline, though prior activity indicates it was actively targeting users through deceptive login interfaces mimicking legitimate wallet services. No specific brand impersonation has been confirmed, but the infrastructure aligns with common wallet credential theft tactics observed in similar campaigns. Analysis indicates that kkra30at.ru was flagged by 14 of 95 security vendors on VirusTotal, a clear indicator of its malicious nature. The domain was registered on March 21, 2025, through TIMEWEB-RU, a registrar frequently associated with high-risk domains. It resolved to the IP address 92.53.116.105, located in Russia under the RZT-TimeWeb2 hosting provider. The domain appeared on three security blocklists, reinforcing its classification as a confirmed threat. Notably, the absence of an SSL certificate further undermines any semblance of legitimacy, as modern phishing sites typically employ encryption to evade detection. At present, kkra30at.ru is offline, reducing immediate exposure risk. However, the infrastructure and registration details suggest potential for reactivation or migration to a new domain. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and its associated IP address, while security teams are encouraged to analyze historical DNS and WHOIS records for additional indicators of compromise. Proactive measures, such as deploying network-level filters and educating users on recognizing crypto drainer phishing tactics, are critical to mitigating future risks from similar threats.