kra46rc[.]com

Analysis of the domain kra46rc.com, observed as offline as of the report date July 24, 2026, indicates a targeted brand‑impersonation campaign aimed at Kraken users. The domain was registered on 26 November 2025 through the registrar MAT BAO CORPORATION and resolves to the IP address 172.67.141.2, which belongs to Cloudflare's network (ASN13335, United States). Both authoritative nameservers listed for the domain—miguel.ns.cloudflare.com and pam.ns.cloudflare.com—are Cloudflare‑provided, suggesting the attackers leveraged a reputable CDN to hide the true origin of the hosting infrastructure. No TLS certificate is present, confirming that the site was served over plain HTTP before being taken down. The page title retrieved from the site, “KRAKEN | Кракен официальный сайт kra46cc, kra46at, даркнет маркет ссылка”, explicitly references the Kraken brand and includes Russian‑language descriptors, reinforcing the conclusion that the site was intended to masquerade as an official Kraken portal.

The campaign is classified as a crypto‑scam, consistent with the brand impersonation and the use of terms such as “darknet market” in the title. Reputation services provide mixed signals: VirusTotal recorded three positive detections out of ninety‑five scanners, and the domain appears on a single blocklist, PhishDestroy. Gridinsoft assigned a trust score of zero out of one hundred, indicating a high likelihood of malicious intent. These independent indicators converge on a high‑confidence assessment that the domain was malicious, despite the limited number of blocklist entries. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no HTTP response codes, content snapshots, or malware samples have been disclosed.

The absence of a TLS certificate prevents verification of any potential phishing login pages, and the site’s current offline status limits direct observation of its behavior.