ksm-china[.]com

The domain ksm-china.com was observed hosting a cryptocurrency‑related impersonation campaign targeting the Kraken exchange. The site was secured with a Let’s Encrypt R12 certificate, indicating a recent TLS deployment but offering no authentication of ownership. DNS resolution points to 172.67.172.57, an IP owned by Cloudflare (AS13335) located in the United States, and the authoritative name servers are decker.ns.cloudflare.com and tricia.ns.cloudflare.com, both Cloudflare‑managed. HTTP requests return a 403 status, suggesting the content is currently inaccessible; the host has been taken offline and is listed as such by multiple sink‑hole services. The page title returned during the brief probe was “Kusama官网”, a Chinese phrase meaning “Kusama official website”, which does not match the advertised Kraken brand and may be an attempt to lure Chinese‑speaking users.

Technical fingerprinting shows the server runs Apache HTTP Server with PHP support, a common stack for cheaply hosted scam pages. Registration data indicates the domain was created on 29 March 2021 through Dynadot LLC, a registrar frequently used for disposable domains. Reputation checks show the domain appears on two independent blocklists, and both PhishDestroy and Enkrypt have flagged it as malicious. VirusTotal recorded a single positive detection out of 95 scanners, reinforcing the suspicion of malicious intent. Independent scoring services assign a Gridinsoft trust score of 0 / 100, effectively marking the site as untrusted.

The campaign is classified as a crypto scam, with the explicit claim of impersonating Kraken. No additional evidence such as phishing form URLs, credential harvest endpoints, or malware payloads has been captured, leaving the exact attack vector unknown. Defenders should block DNS resolution for ksm-china.com, add the IP address 172.67.172.57 to network‑level deny lists, and ensure that any alerts referencing Kraken‑related credential theft are correlated with this indicator.