kra-36i[.]ru

PhishDestroy identifies kra-36i.ru as an active crypto drainer domain designed to impersonate legitimate login interfaces, likely targeting cryptocurrency users. The domain is registered through RU-CENTER-RU and resolves to IP address 188.114.97.3. Technical analysis indicates the threat operates as a generic phishing campaign, leveraging deceptive login pages to harvest credentials or initiate unauthorized transactions.

This domain was flagged by VirusTotal with a detection score of 1 out of 95 security vendors. The domain was created on June 07, 2025, and utilizes an SSL certificate issued by Google Trust Services, which may enhance its credibility. Despite the low detection rate, the presence of a valid SSL certificate and recent registration date suggest an evolving threat aimed at evading detection. The domain remains unlisted on major blocklists at this time, indicating a newly active campaign.

As of current analysis, kra-36i.ru remains active with an elevated risk level. Users are advised to avoid interacting with this domain and verify any suspicious links using PhishDestroy’s real-time threat intelligence platform. Immediate blocking of the associated IP (188.114.97.3) and domain is recommended to mitigate potential exposure. While the immediate risk is elevated, proactive monitoring and user vigilance are critical to preventing credential theft or financial loss.