krakcom[.]net[.]krakenashop[.]com

Analysis of the domain krakcom.net.krakenashop.com indicates it is a high-risk brand impersonation site targeting Kraken, a cryptocurrency exchange. The domain was registered on December 1, 2025, through NiceNIC International Group Co., Limited and resolves to the IP address 185.208.156.66, hosted on AS42624 (Global-Data System IT Corporation) in Switzerland. As of July 23, 2026, the domain is offline, though it was previously flagged for social engineering by Google Safe Browsing and appears on one security blocklist. The page title, 'Кракен шоп | официальный маркетплейс кракен,' suggests the site posed as an official Kraken marketplace, likely targeting Russian-speaking users. Infrastructure analysis reveals the domain used nameservers ns1.safe-networks.net and ns2.safe-networks.net, which may be associated with other malicious activity, though further pivoting is required for confirmation.

No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data. Detection vendors on VirusTotal flagged the domain, with 15 out of 95 security tools identifying it as malicious, though the specific nature of the threat (e.g., phishing, malware distribution) remains unverified due to the site's current offline status. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as a high-risk domain. Defenders should treat this domain as part of a broader crypto scam campaign impersonating Kraken.

While the site is offline, the infrastructure (IP, nameservers, registrar) may be reused for future attacks. Organizations should block the domain, IP, and associated nameservers at the network level and monitor for related domains registered through the same registrar or hosting provider. Users who may have interacted with the site should be advised to revoke any connected wallet permissions, reset credentials, and scan for malware.