kra35-cc[.]com

This domain, kra35-cc.com, is identified as a brand impersonation threat targeting the Kraken cryptocurrency exchange platform. Analysis confirms it operates as a fraudulent login portal, designed to harvest user credentials under the guise of an official Kraken interface. The domain is currently offline, but prior activity indicates malicious intent. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.96.3. It was created on March 27, 2026, and has been flagged by 14 of 95 security vendors on VirusTotal. Additionally, the domain appears on three security blocklists, further corroborating its malicious classification. The SSL certificate is issued by Let's Encrypt (serial number E8), and the page title explicitly mimics Kraken’s official branding with the text 'kra35.cc - Официальный вход Kraken,' suggesting a targeted phishing campaign against Russian-speaking users. The domain’s current offline status does not mitigate its risk, as threat actors frequently reactivate such infrastructure. Organizations and users are advised to block the domain and its associated IP (188.114.96.3) at the network level. Security teams should monitor for related indicators, including the unique seed e8ebd7, and conduct retrospective log analysis to identify prior interactions. Users who may have accessed this domain should immediately reset their Kraken credentials and enable multi-factor authentication on all financial accounts. Proactive measures, such as domain monitoring and user education on brand impersonation tactics, are recommended to prevent future exposure.