kra33-at-cc[.]com

This domain, kra33-at-cc.com, is flagged as a confirmed brand impersonation site targeting Kraken, a major cryptocurrency exchange. Analysis of the page title, 'Kraken33 – Всегда рабочий вход на kra33,' indicates an intent to deceive users into believing they are accessing a legitimate Kraken login portal. The domain appears designed for credential theft, likely aimed at harvesting login details from unsuspecting cryptocurrency traders seeking access to their accounts. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with known credential harvesting tactics. Infrastructure analysis reveals multiple technical indicators supporting the classification of this domain as malicious. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.202.209, hosted by Cloudflare, Inc. in Canada. It was created on March 27, 2026, an anomalous future date suggesting potential obfuscation or misconfiguration. The domain is flagged by 9 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is commonly exploited by threat actors to lend credibility to malicious sites. Google Safe Browsing (GSB) has not explicitly listed this domain, but the combination of indicators warrants elevated scrutiny. As of the latest assessment, kra33-at-cc.com has been taken offline, reducing immediate exposure to users. However, the domain remains a residual risk due to its recent activity and the potential for reactivation or migration to a new infrastructure. Organizations and individuals are advised to block this domain at the network level and monitor for related indicators of compromise, such as the associated IP address or SSL certificate thumbprint. Users who may have interacted with this domain should immediately reset their credentials and enable multi-factor authentication on their legitimate accounts. Proactive threat hunting for similar domains registered through the same registrar or resolving to the same IP range is recommended to mitigate future risks.