kra49[.]shop

Analysis of the domain kra49.shop, observed on July 24 2026, indicates that the site is being used for brand impersonation of Kraken. The domain was registered on February 21 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. DNS resolution points to the IP address 104.21.37.248, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is present, meaning the site served only HTTP, which reduces user confidence and may facilitate credential capture.

The page title returned from the server is “krab5.cc”, a mismatch that suggests the domain may have been pointed to a generic landing page or placeholder content rather than a Kraken‑branded interface. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. The domain appears on a single security blocklist and has been specifically blocked by the PhishDestroy service, further confirming malicious intent. VirusTotal analysis shows that one of ninety‑three scanning engines flagged the domain, providing independent confirmation of suspicious behavior.

Nameserver records list imani.ns.cloudflare.com and jakub.ns.cloudflare.com, both Cloudflare authoritative servers, consistent with the hosting provider. The limited public evidence leaves open questions about the exact phishing kit, the presence of credential‑stealing forms, and the timeline of active exploitation before the takedown. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the same IP or nameserver pair, and update internal threat feeds with the observed indicators of compromise, including the domain name, IP address, and associated blocklist entries. Ongoing vigilance is advised, especially for users of Kraken services, to prevent credential compromise from similar impersonation attempts.