krakendarknet[.]tilda[.]ws

The domain krakendarknet.tilda.ws was observed on July 12, 2026 and is classified as a high‑risk brand‑impersonation campaign targeting the cryptocurrency exchange Kraken. The site returns an HTTP 403 status code and presents a TLS certificate issued by CentralNic Luxembourg Sàrl under the GlobeSSL DV CA. Its registration date is 28 March 2026 and the domain is hosted on the Tilda publishing platform. The domain resolves to the IPv4 address 194.48.203.15, which is allocated to Tilda Publishing Ltd in Ireland. It appears on a single security blocklist and is actively blocked by the PhishDestroy feed. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of legitimacy. VirusTotal analysis shows that 1 out of 95 scanned security vendors flagged the host as malicious, reinforcing the suspicion despite the low detection count. The only publicly visible attribute is the page title “403”, which suggests that the server is currently refusing client requests, possibly as a tactic to evade automated crawling while retaining the malicious infrastructure. No additional content, login portals, or credential‑harvesting forms have been captured, leaving the exact malicious payload or phishing template undefined. Defenders should immediately add krakendarknet.tilda.ws to their deny‑list and block outbound connections to 194.48.203.15 at the network perimeter. Continuous DNS monitoring is advised to detect any rapid re‑registration or CNAME aliasing that could be used to bypass static blocks. Given the use of the Tilda hosting service, security teams should expand their watchlist to include other recent Tilda‑based domains created after March 2026, as they may share the same infrastructure. Endpoint protection policies should be updated to flag any attempted communications with the listed certificate issuer, and incident response procedures should be prepared to handle potential credential‑stealing attempts aimed at Kraken users.