tor-darkmarkets-online[.]com

This domain is classified as a high-risk brand impersonation threat specifically targeting Kraken, a cryptocurrency exchange platform. Analysis of the infrastructure indicates an attempt to deceive users into believing they are accessing an official Kraken mirror site, as evidenced by the page title "Kraken - официальное зеркало площадки ⭐️ Рабочая 24/7 ссылка через Тор и обычный ВПН." The domain poses a significant risk of credential theft, financial fraud, and unauthorized access to user accounts, particularly those associated with cryptocurrency transactions.

Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and currently resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendors on VirusTotal flagged the domain as malicious, with 10 out of 95 detections. It appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging widely trusted certificate authorities. The domain’s status is currently offline, though this does not eliminate the risk of re-emergence under similar infrastructure.

To mitigate risks associated with this type of brand impersonation, users should verify the authenticity of any cryptocurrency exchange site by cross-referencing official domain listings provided by the platform. Enabling multi-factor authentication (MFA) on all financial and cryptocurrency accounts adds an additional layer of security. Users should also monitor for unauthorized transactions and report suspicious domains to relevant threat intelligence platforms. Organizations should implement domain monitoring to detect newly registered domains mimicking their brand and proactively block known malicious infrastructure at the network level.