xn--ka47-5g5a[.]cc

This domain, xn--ka47-5g5a.cc, is identified as a brand impersonation threat specifically targeting Kraken, a cryptocurrency exchange platform. The domain is currently offline, but prior analysis confirms its malicious intent to deceive users by mimicking the legitimate Kraken brand. The page title captured during active monitoring was "KRAKEN," further corroborating the impersonation attempt. Analysis indicates the domain was flagged by 12 of 95 security vendors on VirusTotal, reflecting a significant detection rate. It was registered on December 10, 2025, through NiceNIC International Group Co., Limited, and resolves to the IP address 101.99.75.246, hosted in the Netherlands under AS45839 (Shinjiru Technology Sdn Bhd). The domain appears on one security blocklist, and its SSL certificate is issued by an entity associated with phishing infrastructure. Infrastructure analysis reveals the domain was created recently, aligning with typical phishing campaign timelines. The domain is currently offline, but its prior activity and technical indicators warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP address (101.99.75.246) at the network level. Security teams should review logs for any prior connections to this domain or IP and implement detection rules for similar impersonation attempts targeting Kraken or other financial platforms. If encountered, users should report the domain to their security providers for further analysis and mitigation.