kra34cc[.]net

This domain, kra34cc.net, operates as a fraudulent login portal impersonating the Kraken cryptocurrency exchange. The page displays a Russian-language login interface titled 'KRA34.cc - Вход в Кракен,' designed to harvest credentials from users attempting to access their crypto wallets. Analysis indicates this is a credential theft operation targeting Russian-speaking cryptocurrency holders, likely aiming to gain unauthorized access to exchange accounts and steal digital assets. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing infrastructure. It resolves to IP address 104.21.31.160 and employs Cloudflare services alongside HTTP/3 protocol. Security vendors flagged the domain in 16 out of 95 VirusTotal scans, while it appears on one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly exploited by threat actors to lend false credibility to malicious sites. Users who visited kra34cc.net should immediately revoke any entered credentials and enable multi-factor authentication on their legitimate Kraken accounts. All devices used to access the site should undergo malware scanning, as credential harvesters often deploy secondary payloads. Cryptocurrency holders should monitor their accounts for unauthorized transactions and consider transferring assets to new wallets if compromise is suspected. The domain has since been taken offline, but similar phishing sites may reappear under different names using identical infrastructure patterns.