kpa29[.]cc

The domain kpa29.cc was registered on 26 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. DNS resolves to 188.114.96.3, which is hosted in Canada by a CDN operator. The site returns an HTTP 301 redirect and presents the page title “KRAKEN”, indicating a brand impersonation of Kraken. TLS is provided with a certificate issued by a major public certificate authority. Infrastructure analysis shows the use of HTTP/3 and browser insight scripts typical of CDN‑backed services. The domain is listed on one security blocklist and has been flagged by PhishDestroy. Reputation scoring from an independent tool rates the domain at 0/100. VirusTotal records 14 detections out of 94 scanning engines. Nameservers are configured to two generic CDN nodes. Evidence confirms that the domain is being used for a high‑risk brand‑impersonation campaign targeting Kraken users. However, the exact malicious payload or credential‑collection page has not been publicly disclosed, leaving the specific attack vector uncertain. Defenders should block network resolution to 188.114.96.3, add kpa29.cc to URL filtering and email security policies, and monitor for any related traffic signatures. Continuous re‑evaluation is advised as additional detections may emerge.