akrn[.]to

Analysis of akrn.to as of July 24, 2026 shows a high‑risk brand‑impersonation campaign targeting Kraken users. The site resolves to 104.21.15.96, an address owned by Cloudflare (AS13335) located in the United States. DNS is served by cash.ns.cloudflare.com and kara.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS connection. HTTP responses return status code 200 and the page title reported by scanners is “Академия KRAKEN”, confirming the presence of the Kraken brand in the content. Technical fingerprints include a Node.js stack with React, Next.js, Express, Webpack and HTTP/3, as well as the Yandex.Metrika analytics tag, all typical of modern web applications but not indicative of benign intent.

The domain was registered on April 07, 2025 through the Government of the Kingdom of Tonga, a registrar frequently abused for malicious domains. Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. One of ninety‑five VirusTotal scanners flags the site, and PhishDestroy lists it as blocked, reinforcing the malicious classification. No additional public threat‑intel feeds are referenced in the available data. Defenders should treat any traffic to akrn.to as hostile.

Immediate actions include adding the domain and its resolving IP 104.21.15.96 to deny‑list rules on perimeter firewalls and proxy devices, monitoring DNS logs for lookups, and ensuring endpoint protection solutions are updated to reflect the single vendor detection. Because the site hosts a crypto‑scam façade, users should be warned not to enter credentials or financial information. Continuous monitoring of Cloudflare‑hosted IP ranges for new domains registered by the same registrar may help detect future iterations. The evidence currently lacks visual page analysis, so further sandbox inspection is advised to confirm any credential‑capture mechanisms.