kraken-market-onion[.]com

Analysis of the domain kraken-market-onion.com indicates a targeted brand impersonation campaign against Kraken, a well-known cryptocurrency exchange. The domain was registered on March 13, 2026, through NiceNIC International Group Co., Limited, and was operational until recently taken offline. Infrastructure analysis reveals the domain resolved to IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States, utilizing Cloudflare's nameservers (celine.ns.cloudflare.com and neil.ns.cloudflare.com). The site employed Cloudflare Browser Insights and HTTP/3, common for performance optimization but also frequently leveraged by threat actors to obscure malicious activity.

The page title, 'Kraken Маркетплейс | Крупнейший русскоязычный даркнет рынок,' explicitly references Kraken while positioning itself as a major Russian-language darknet marketplace, suggesting an intent to deceive users seeking illicit or alternative trading platforms. This aligns with the scam type classified as a crypto scam, though the exact mechanics of the fraud remain unconfirmed due to the domain's current offline status. The domain appears on at least one security blocklist, and 14 of 95 security vendors on VirusTotal flagged it as malicious, providing concrete evidence of its suspicious nature. The SSL certificate issued by Let's Encrypt (serial number E8) is valid and typical for both legitimate and malicious sites, offering no definitive indication of intent.

Defenders should treat this domain as a confirmed impersonation threat, particularly given its association with darknet market branding and the use of Russian-language content. While the domain is currently offline, organizations should monitor for re-emergence or similar domains leveraging the same infrastructure, registrar, or naming conventions. Proactive blocking of the resolved IP and associated Cloudflare nameservers may mitigate risk if further activity is detected.