kraken-sayt[.]cc

This domain, kraken-sayt.cc, was first registered on July 29 2025 through NiceNIC International Group Co., Limited and is currently served by the authoritative name servers a.dnspod.com, b.dnspod.com and c.dnspod.com. Network resolution points to the IPv4 address 144.31.93.48, which belongs to AS207957 SERV.HOST GROUP LTD and is geolocated in Russia. The web server responds with an HTTP 301 redirect and presents a TLS certificate issued by Let’s Encrypt (R13), indicating that encryption is in place but that the certificate is publicly available. Fingerprinting of the host reveals an Ubuntu operating system running Nginx, a common stack for compromised or rented infrastructure. The page title returned from the redirected resource reads “KRA - всегда свежие продукты в нашем маркете”, a Russian phrase unrelated to the advertised brand, suggesting that the site is being used as a lure rather than a legitimate storefront.

The domain is classified as a crypto‑scam that impersonates the cryptocurrency exchange Kraken. Analysis of threat‑intel feeds shows that PhishDestroy has already blocked the domain and that it appears on one external security blocklist. VirusTotal records indicate that 14 of 93 scanned security engines label the domain as malicious, reinforcing the suspicion of abuse. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating.

These multiple independent indicators converge on a high‑risk assessment. Defenders should add kraken-sayt.cc and its resolved IP address 144.31.93.48 to network‑level deny lists, enforce DNS‑sinkholing for the associated dnspod name servers, and monitor any outbound connections to the Russian hosting AS for signs of credential harvesting or crypto‑draining activity. Endpoint protection solutions that incorporate the VirusTotal detection count can be tuned to generate alerts on any user interaction with the domain.