Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is 6opw59924@ningqi.live.
The latest stored availability evidence still shows the domain reachable; 1 month has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
ch-clashverge[.]com[.]cn
“Kraken 中文官网 — Kraken交易所电脑版下载”
ch-clashverge.com.cn — Non verificato. Simulazione del marchio: Kraken; Tipo di truffa: Brand Impersonation. Riepilogo delle prove: VirusTotal 7/91 (alphaMountain.ai, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet); Spamhaus DBL_PHISH; 2 external blocklist matches (MetaMask, SEAL); PhishDestroy score 85/100. Registrar: Dominet (HK).
L’analisi dettagliata di PhishDestroy AI resta in inglese per preservare il rapporto forense originale.
The domain ch-clashverge.com.cn was registered on May 06, 2026 through Dominet (HK)Limited and resolves to the IP address 47.86.107.202, which is assigned to AS45102 Alibaba (US) Technology Co., Ltd. and geolocated to Hong Kong. The site presents the page title "Kraken 中文官网 — Kraken交易所电脑版下载," explicitly referencing the Kraken brand and indicating a brand‑impersonation campaign targeting users of the cryptocurrency exchange. An SSL certificate issued by Let’s Encrypt (YR1) is present, confirming that the site supported HTTPS at the time of observation. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting detection by multiple anti‑phishing services.
VirusTotal analysis recorded 2 detections out of 91 scanning engines, providing limited but corroborating evidence of malicious intent. Nameserver records point to ns7.alidns.com and ns8.alidns.com, typical of domains hosted on Alibaba Cloud infrastructure. The current status is offline, suggesting the site has been taken down or is no longer serving content.
While the page title and blocklist presence confirm a brand‑impersonation vector, the exact content of the landing page, credential‑collection mechanisms, and any additional payload have not been captured, leaving those aspects unverified. Defenders should continue to monitor the associated IP address and its ASN for any re‑use, enforce domain‑based blocking for ch-clashverge.com.cn in email and web filters, and update threat intel feeds with the observed indicators. Additional investigation of the hosting provider and any related subdomains may reveal further infrastructure used in the campaign.
Pipeline di risposta alle minacce
Stato della lista di blocco pubblica
Analisi di VirusTotal
Dati e relazioni esterne
PD-20260624-937BD1 Recipient: 6opw59924@ningqi.live Questo sito ti ha influenzato in qualche modo?
Se hai inserito credenziali dell'account, informazioni personali o di pagamento oppure hai scaricato un file da questo dominio, agisci immediatamente. Di seguito sono riportate le risorse per aiutarti a segnalare l'incidente e proteggerti.
Segnalalo alle autorità locali
Seleziona il tuo Paese per ottenere contatti ufficiali del crimine informatico o creare una bozza di reclamo →.
Verifica qualsiasi dominio
Analisi delle minacce utilizzando blocklist archiviate, WHOIS, DNS e prove di scansione pubblica
Scansiona oraSegnala un tentativo di phishing
Segnala i domini sospetti al nostro database delle minacce — proteggi la comunità
SegnalaFeed in tempo reale sulle minacce
Segnalazioni recenti di phishing e modifiche osservate della disponibilità
MonitoraRimani informato, rimani al sicuro
Controlla le minacce in tempo reale oppure contesta questa segnalazione se ritieni che si tratti di un falso positivo