kraken-zerkalo-ssilka[.]com

This domain, kraken-zerkalo-ssilka.com, is identified as a brand impersonation threat targeting Kraken, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic legitimate Kraken services, likely to deceive users into divulging credentials or transferring assets under false pretenses. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and naming convention align with known impersonation tactics used in credential theft campaigns. Technical indicators reveal the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.39.8, a Cloudflare-hosted endpoint commonly used to obfuscate malicious infrastructure. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. Despite its inactive status, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations are advised to monitor for indicators of compromise, including logs of connections to 104.21.39.8 or DNS queries for kraken-zerkalo-ssilka.com. Users should verify domain authenticity before engaging with any cryptocurrency-related services and report suspicious activity to relevant security teams for further investigation.