kpa27[.]cc

This domain is flagged as a high-risk brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was specifically designed to deceive users by mimicking official Kraken infrastructure, leveraging similar naming conventions and page titles to establish false credibility. The threat type is classified as brand impersonation phishing, with intent to harvest credentials or distribute malicious payloads under the guise of a trusted service.

Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain kpa27.cc was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to IP address 188.114.97.3, hosted on AS13335 Cloudflare, Inc. in the United States. Security vendors on VirusTotal flagged the domain at a rate of 11/95, while it appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is commonly exploited by threat actors to lend an appearance of authenticity. The page title, "KRA27.CC — стабильный доступ через kraken27.cc," explicitly references Kraken, reinforcing the impersonation attempt.

Mitigation steps for this threat type include immediate domain takedown requests to registrars and hosting providers, leveraging the provided blocklist data to update security filters. Organizations should monitor for similar domain squatting patterns, such as permutations of the target brand name combined with numeric sequences or regional language phrases. End users should be educated to verify domain authenticity through official channels and avoid interacting with unsolicited links, particularly those promising "stable access" or alternative gateways. Security teams are advised to implement strict SSL certificate validation policies and monitor for unauthorized use of brand-related keywords in newly registered domains.