onionblog[.]online

On July 24, 2026, the domain onionblog.online was observed to host a page with the title “Кракен даркнет вход - Кракен даркнет вход”. The title explicitly references the Kraken brand, confirming the intelligence label of a brand‑impersonation campaign targeting Kraken users. The domain was registered on 28 June 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (nameservers burt.ns.cloudflare.com and malavika.ns.cloudflare.com). DNS resolution returns the IP address 172.67.202.97, which belongs to AS13335 Cloudflare, Inc., and is geolocated to the United States. No TLS certificate was presented, indicating that the site was served over plain HTTP.

VirusTotal reports that 2 of 95 scanning engines flagged the domain, confirming malicious intent without specifying detection categories. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy sinkhole. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The current HTTP status is offline, suggesting that the site has been taken down or is otherwise unreachable. While the exact content of the landing page has not been captured, the combination of a brand‑specific title, the lack of encryption, low trust score, and multiple vendor detections provides strong evidence of a credential‑harvesting operation aimed at Kraken users.

Uncertainty remains regarding the full scope of the phishing kit, any associated command‑and‑control infrastructure, and whether additional domains share the same infrastructure. Defenders should block or sinkhole 172.67.202.97 and add onionblog.online to local blacklists. Email and web gateway filters should be updated to detect the brand‑impersonation pattern, and users of Kraken services should be warned not to enter credentials on sites lacking a valid TLS certificate.