kra-41-cc[.]cc

The domain kra-41-cc.cc is a phishing site engaged in brand impersonation targeting users of the cryptocurrency exchange Kraken. It presents itself as an official Kraken mirror site, using deceptive page titles such as 'Kra41.cc — Официальный сайт Kraken | Рабочее зеркало Kra41.at' to trick victims into believing it is legitimate. This scam is classified as a cryptocurrency phishing operation, though no drainer kit was identified. As of the latest verification, kra-41-cc.cc has been taken offline.

Technical indicators confirm the malicious nature of kra-41-cc.cc. The domain was registered on October 24, 2025, through NameSilo, LLC, and resolves to the IP address 104.21.0.184, hosted on Cloudflare's infrastructure in the US. Security vendors flagged the domain, with 2 of 95 VirusTotal vendors detecting it as malicious, including alphaMountain.ai and Forcepoint ThreatSeeker. It appears on one security blocklist, PhishDestroy, though Google Safe Browsing has not flagged it. The domain lacks an SSL certificate, and its nameservers are cash.ns.cloudflare.com and kallie.ns.cloudflare.com.

Victims of kra-41-cc.cc should take immediate action to secure their accounts and assets. If credentials were entered on the site, change passwords for all associated accounts, enable two-factor authentication, and monitor for unauthorized transactions. For cryptocurrency users, revoke any token approvals granted to suspicious sites and consider transferring funds to a new wallet. Report the phishing domain to the impersonated brand, Kraken, and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to prevent further abuse.