kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7instad-onion[.]cc

Analysis of kraken2trfqodidvlh4aa337...onion.cc indicates a high‑risk brand impersonation campaign targeting Kraken users. The domain was registered on March 26 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on CloudFlare infrastructure, resolving to IP 188.114.96.3, which is associated with CloudFlare, Inc. in CA. The site presents a HTTP 301 redirect and serves an SSL certificate issued by Google Trust Services under the WE1 authority, suggesting legitimate‑looking TLS termination. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records nine detections out of 94 scanning engines. The domain appears in eight AlienVault OTX threat pulses and is listed on one security blocklist, with PhishDestroy already blocking it. The page title returned is "Captcha," and the campaign is classified as a fake exchange, confirming the impersonation of Kraken’s trading platform. Infrastructure signals, such as the use of CloudFlare nameservers (miguel.ns.cloudflare.com, raquel.ns.cloudflare.com), reinforce that the attacker is leveraging reputable services to mask malicious intent. Defenders should immediately add the domain and its resolved IP address to outbound and inbound filtering rules, monitor DNS queries for this FQDN, and enforce strict authentication controls for any Kraken‑related services. Continuous threat‑intel feeds should be consulted for new indicators, and any credential‑based incidents involving Kraken should be investigated for possible exposure to this infrastructure.