krak77[.]icu

Analysis of the domain krak77.icu indicates it was actively impersonating the Kraken cryptocurrency platform as part of a crypto scam operation. The domain, created on February 21, 2026, resolved to the IP address 188.114.97.3, hosted on Cloudflare infrastructure (AS13335) in the United States. The page title, 'Kraken Darknet Marketplace | Рабочая ссылка 2025,' explicitly references Kraken alongside Russian-language text, suggesting targeting of users seeking darknet access to cryptocurrency services.

Six out of ninety-three security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist prior to being taken offline. The SSL certificate was issued by WE1, a provider commonly used by both legitimate and malicious sites, offering no definitive indication of intent. While the domain is currently offline, its infrastructure and branding align with known patterns of crypto scams impersonating Ethereum-related services.

Defenders should treat this domain as part of a broader campaign targeting cryptocurrency users, particularly those searching for darknet market access. Historical DNS and WHOIS records should be reviewed for additional indicators, and any residual DNS resolutions or subdomains should be monitored for reactivation. The presence of Russian-language content in the page title may indicate regional targeting, warranting heightened scrutiny of related infrastructure.