kraken-24[.]cc

kraken-24.cc was registered on 21 February 2026 and is currently offline. The domain is listed on the PhishDestroy blocklist, indicating that at least one security organization has identified it as malicious. The site’s title, “Кракен - ведущая даркнет площадка, обзор, ссылки, обхд блокировки”, references the well‑known cryptocurrency exchange Kraken, confirming a brand‑impersonation intent. The known scam type is a crypto scam, suggesting that the operator likely sought to harvest credentials or funds from users believing they were interacting with the legitimate Kraken platform. Technical resolution shows the domain pointing to IP 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States.

Use of a Cloudflare front‑end is common for fast‑flux or anonymized phishing infrastructure, but the specific IP does not appear to host other known malicious payloads. The SSL certificate presented for the host is identified only as “WE1”, lacking a recognizable subject name that matches the brand, further indicating a low‑trust certificate typically employed by fraudulent sites. VirusTotal analysis recorded ten detections out of ninety‑three scanners, confirming that multiple AV engines flagged the domain as malicious. The exact nature of the detections (e.g., phishing, downloader, or crypto‑drainer) was not disclosed, so the precise payload remains uncertain.

No additional intelligence such as OTX tags, registrar details, or Safe Browsing verdicts were provided. Given the available evidence, defenders should continue to block kraken-24.cc at network perimeter and DNS layers, monitor for any resurgence of the domain, and treat any traffic to the associated IP as suspicious. Organizations that use Kraken services should educate users about the spoofed page title and reinforce verification of TLS certificates, especially when presented with generic identifiers like “WE1”.