kra49cc[.]com

The domain kra49cc.com has been identified as a generic phishing threat, specifically a crypto drainer that lures victims into connecting their wallets via a fake captcha page. The page title "Captcha" is a common social engineering technique to trick users into performing actions that drain their cryptocurrency assets. No specific brand impersonation was detected, but the domain's sole purpose appears to be wallet credential theft.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports 4 out of 95 security vendors flagging this domain, placing it in the elevated risk category. The domain was created on March 27, 2026, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 172.67.194.179. It uses an SSL certificate from Google Trust Services (WE1) and appears on one security blocklist. AlienVault OTX has recorded it in one threat intelligence pulse, confirming its association with malicious activity.

As of the latest check, kra49cc.com is offline, indicating that hosting providers or registrars have taken action to disrupt the campaign. However, the domain remains a risk if it becomes active again or if similar domains emerge. Users are strongly advised never to interact with captcha pages from untrusted sources, especially those requesting wallet connections. PhishDestroy recommends blocking this domain and monitoring for related threats with similar infrastructure.