kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7intad-onion[.]com

This domain, kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7intad-onion.com, is identified as a brand impersonation threat targeting Kraken, a major cryptocurrency exchange. Analysis indicates the domain mimics legitimate Kraken infrastructure to deceive users into disclosing sensitive credentials, such as login details or private keys. The page title, "Google," suggests an attempt to obfuscate the malicious nature of the site by masquerading as a benign service, a common tactic in phishing campaigns to evade user suspicion during initial interaction.

Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026, an unusually forward-dated registration that may indicate an attempt to bypass automated detection systems. It resolves to the IP address 89.124.90.206, hosted in the Netherlands under Servers Tech Fzco. The domain is flagged by 16 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E7), provides a veneer of legitimacy but does not mitigate the underlying threat posed by the impersonation.

Users who visited this domain should immediately revoke any credentials or private keys entered on the site, as they are likely compromised. It is recommended to monitor associated accounts for unauthorized transactions and enable multi-factor authentication where available. Additionally, affected users should report the incident to the targeted brand’s security team and consider scanning their systems for malware, as phishing sites often serve as vectors for additional payloads. The domain has since been taken down, but similar threats may emerge using comparable tactics.