kra-33[.]com

This domain, kra-33.com, is identified as a brand impersonation phishing site targeting users of the Kraken cryptocurrency exchange. The site presents itself as a Russian-language mirror under the title 'Kra33.cc — Зеркало Kraken 2025 | Доступ через Kra33 at и Kra33 сс,' suggesting unauthorized access to the legitimate platform. Analysis indicates the domain is designed to deceive users into divulging login credentials or transferring digital assets to attacker-controlled wallets, a common tactic in cryptocurrency phishing schemes. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.68.119, which is part of a cloud hosting range known for abuse. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with detection names including 'Phishing' and 'Malicious Site.' It appears on one security blocklist and was previously detected in a single AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Google Trust Services, a common practice among phishing sites to mimic legitimacy. As of the latest assessment, kra-33.com has been taken offline, likely in response to detection and reporting by security entities. However, the domain remains a residual risk due to its recent registration and historical association with phishing infrastructure. Users who may have interacted with the site are advised to rotate credentials immediately, monitor accounts for unauthorized transactions, and verify the authenticity of any communications claiming to be from Kraken. The elevated risk level persists until the domain is permanently sinkholed or seized by authorities.