kraken[.]kraken-ssylka[.]click

On 24 July 2026, the domain kraken.kraken-ssylka.click was observed serving an HTTP 403 response. The site is hosted on Cloudflare infrastructure (ASN 13335) and resolves to 172.67.166.14, a location attributed to the United States. Registration data indicates the domain was created on 5 April 2026 through Dynadot, LLC, and uses Cloudflare’s default nameservers cory.ns.cloudflare.com and martha.ns.cloudflare.com. The TLS certificate is issued by Let’s Encrypt (identifier YE1), confirming that encryption is present but does not imply legitimacy. The page title returned by the server, “Кракен ссылки 2026 рабочая ссылка — Кракен,” directly references the Kraken brand, and the intelligence classification labels the activity as brand impersonation targeting Kraken.

Google Safe Browsing has flagged the domain for social engineering, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have listed the domain, indicating consensus among threat‑sharing communities. VirusTotal analysis shows that 4 of 91 security vendors have generated a detection for the domain, reinforcing the suspicion. Evidence suggests the primary intent is to mislead users seeking Kraken services, potentially to harvest credentials or redirect traffic. However, the site is currently offline, limiting direct observation of malicious payloads or credential‑collection mechanisms. No additional artifacts such as malware hashes, phishing kits, or command‑and‑control endpoints have been disclosed, leaving the exact exploitation vector uncertain.

Defenders should block the domain at the DNS and proxy layers, add the associated IP address 172.67.166.14 to deny‑lists, and monitor for any traffic attempting to resolve or contact the nameservers cory.ns.cloudflare.com and martha.ns.cloudflare.com. Continuous re‑query of VirusTotal and Google Safe Browsing is advised to capture any future detections.