# PhishDestroy threat dossier — krkcontrol25.store ================================================================ Fetched: 2026-07-22 21:31:28 UTC Canonical: https://phishdestroy.io/domain/krkcontrol25.store/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Fake Exchange Targeted brand: Kraken ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: Fortinet AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 191.96.78.192 (BR, Muriaé) ASN: AS270353 Tyna Host - Datacenter no Brasil Hosting org: Tyna Host Datacenter no Brasil Registrar: TLD Registrar Solutions Ltd Nameservers: ["ns-canada.topdns.com", "ns-uk.topdns.com", "ns-usa.topdns.com"] Page title: Kraken 2.0 — Painel ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-10 Status: INVALID chain Fingerprint: cee91f0b2c9d5546132ba7405449092e4a735320aa5fb754401107d0ec121499 Subject Alternative Names (related infrastructure — often same operator): - www.krkcontrol25.store ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-13 00:50:02 UTC (by PhishDestroy tracker) First reported: 2026-07-13 00:57:23 UTC (abuse notice filed) Last verified: 2026-07-22 20:20:27 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f5885-3b9b-747d-b003-f0e27bac02b7/ URLQuery: https://urlquery.net/report/5fb34f29-10b1-460a-96f5-fb0cb6d3e3b1 Wayback Machine: https://web.archive.org/web/*/krkcontrol25.store crt.sh CT logs: https://crt.sh/?q=%25.krkcontrol25.store Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=krkcontrol25.store AlienVault OTX: https://otx.alienvault.com/indicator/domain/krkcontrol25.store URLhaus: https://urlhaus.abuse.ch/host/krkcontrol25.store/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-13 01:25:22 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] krkcontrol25.store: Confirmed Kraken Crypto Exchange Phishing Analysis of the domain krkcontrol25.store confirms its classification as an active phishing site targeting users of the Kraken cryptocurrency exchange. The domain, registered under the title 'Kraken 2.0 — Painel,' directly impersonates Kraken, a known brand in the cryptocurrency sector. Infrastructure analysis reveals the domain resolves to the IP address 191.96.78.192, which has been associated with prior malicious activity in threat intelligence pulses. The domain is currently flagged by one security vendor, though broader detection may still be limited due to its recent deployment or evasion techniques. The SSL certificate issued by Let's Encrypt provides a baseline of encryption, which is commonly exploited by threat actors to lend credibility to fraudulent sites. While the certificate itself is legitimate, its presence does not mitigate the domain's malicious intent. The domain has been included in two threat intelligence pulses, indicating prior identification by security researchers, yet it remains operational as of July 12, 2026. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. Given the targeted nature of the impersonation, users may be lured into entering sensitive credentials or financial information under the false pretense of accessing Kraken services. Organizations should review logs for connections to 191.96.78.192 and the domain itself, particularly in environments where cryptocurrency transactions are common. Further investigation into the hosting infrastructure and associated domains may reveal additional related threats. The exact phishing kit or payload delivered by this domain has not yet been analyzed, but the page title suggests a focus on administrative or account management impersonation. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260713-CFF900 TLS cert SHA-256: cee91f0b2c9d5546132ba7405449092e4a735320aa5fb754401107d0ec121499 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/krkcontrol25.store/ JSON API: https://api.destroy.tools/v1/check?domain=krkcontrol25.store Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,423 domains (57,868 alive under monitoring, 128,922 confirmed takedowns/dead). Site: https://phishdestroy.io