ch-clashverge[.]com[.]cn

The domain ch-clashverge.com.cn was registered on May 06, 2026 through Dominet (HK)Limited and resolves to the IP address 47.86.107.202, which is assigned to AS45102 Alibaba (US) Technology Co., Ltd. and geolocated to Hong Kong. The site presents the page title "Kraken 中文官网 — Kraken交易所电脑版下载," explicitly referencing the Kraken brand and indicating a brand‑impersonation campaign targeting users of the cryptocurrency exchange. An SSL certificate issued by Let’s Encrypt (YR1) is present, confirming that the site supported HTTPS at the time of observation. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting detection by multiple anti‑phishing services.

VirusTotal analysis recorded 2 detections out of 91 scanning engines, providing limited but corroborating evidence of malicious intent. Nameserver records point to ns7.alidns.com and ns8.alidns.com, typical of domains hosted on Alibaba Cloud infrastructure. The current status is offline, suggesting the site has been taken down or is no longer serving content.

While the page title and blocklist presence confirm a brand‑impersonation vector, the exact content of the landing page, credential‑collection mechanisms, and any additional payload have not been captured, leaving those aspects unverified. Defenders should continue to monitor the associated IP address and its ASN for any re‑use, enforce domain‑based blocking for ch-clashverge.com.cn in email and web filters, and update threat intel feeds with the observed indicators. Additional investigation of the hosting provider and any related subdomains may reveal further infrastructure used in the campaign.