kra36-cc[.]com

This domain, kra36-cc.com, has been identified as a brand impersonation threat specifically targeting Kraken, a well-known cryptocurrency exchange platform. Analysis confirms the domain was actively impersonating official Kraken services, presenting itself as an official portal under the title 'kra36.cc - Официальный портал Kraken.' The domain is currently offline, though prior activity suggests it was operational for malicious purposes, likely aimed at credential harvesting or cryptocurrency fraud. Infrastructure analysis reveals several critical indicators of compromise. The domain was created on February 21, 2026, and registered through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3, which is associated with Cloudflare’s network, a common tactic to obscure hosting origins. Security assessments show the domain was flagged by 1 of 95 vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. Additionally, the domain appears on four security blocklists and is blocked by multiple threat intelligence feeds, including MetaMask, SEAL, PhishDestroy, and OISD. Detected technologies include Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3, further indicating an attempt to mimic legitimate service infrastructure. The SSL certificate is issued by Google Trust Services, a detail often exploited to lend false credibility to phishing sites. Given the domain’s current offline status, immediate threats may be mitigated, though residual risk remains due to potential re-emergence under similar infrastructure. Organizations and users are advised to maintain blocklist updates to prevent access if the domain reactivates. Security teams should monitor for related domains registered through NiceNIC or resolving to Cloudflare IPs, particularly those using Google Trust Services SSL certificates. Users who may have interacted with the domain should reset credentials for Kraken and related financial accounts, enable multi-factor authentication, and review transaction histories for unauthorized activity. Proactive threat hunting for similar impersonation patterns is recommended to preempt future campaigns.