kra40at[.]cc

Analysis of kra40at.cc, created on February 21, 2026 and hosted behind Cloudflare (AS13335), shows a high‑risk crypto‑scam that impersonates the Kraken brand. The domain resolves to the IP address 188.114.97.3, which is registered to a US location and is served through Cloudflare’s network, using nameservers aaden.ns.cloudflare.com and elinore.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain but offering no assurance of legitimacy. HTTP requests return a 200 status code, and the page title is reported as "KRAKEN," directly matching the targeted brand.

Security‑vendor scans on VirusTotal flag the domain in 10 of 93 engines, and the site appears on three external blocklists, resulting in active blocks by PhishDestroy, MetaMask, and SEAL. A Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the infrastructure. The registrar listed is NiceNIC International Group Co., Limited, a common conduit for abuse.

While the exact content of the landing page has not been captured, the combination of brand‑matching title, crypto‑scam classification, and multiple vendor detections confirms that kra40at.cc is being used to lure victims into fraudulent Kraken‑related interactions. Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the associated IP and nameservers, and update threat‑intel feeds with the observed indicators. Additional investigation of the site’s payloads, if any, would clarify the specific phishing mechanisms employed, but current evidence already warrants a high‑severity classification and proactive mitigation.