kra6cc[.]xyz

This domain, kra6cc.xyz, was registered on 27 February 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers ali.ns.cloudflare.com and zahir.ns.cloudflare.com resolve the domain to the IP address 172.67.153.63, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was observed for the host, indicating that HTTPS connections are not offered. The page title returned by the HTTP response is “slon2.cc”, which does not reference the targeted brand.

However, intelligence flags the domain as an impersonation of the cryptocurrency exchange Kraken, and the brand target field explicitly lists Kraken. VirusTotal analysis shows that 2 of 93 security vendors have raised a detection on the domain, and the domain is listed on a single external blocklist. PhishDestroy has also added the domain to its blocklist, and the current operational status is recorded as offline. The elevated risk rating reflects the combination of brand impersonation, the use of Cloudflare infrastructure, and the presence of detections on multiple security platforms.

At present, the exact content of the site has not been captured, and the lack of a valid SSL certificate prevents verification of any credential‑harvesting forms. Defenders should continue to block the domain at perimeter filters, monitor the associated IP address for any future activity, and update threat‑intel feeds with the observed indicators. Additional analysis of the page title and any future re‑hosting attempts would be required to confirm the phishing kit or payload used.