xn--kr43-onb[.]com

Analysis indicates that the domain xn--kr43-onb.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is presently active. DNS resolution points to the IPv4 address 101.99.76.111, which is hosted in the Netherlands and belongs to ASN 45839 operated by Shinjiru Technology Sdn Bhd. The server stack consists of Ubuntu Linux running Nginx with a Node.js/Express application layer, as identified by passive fingerprinting tools. An HTTPS endpoint is present, signed by a Let’s Encrypt R12 certificate, but HTTP requests return a 403 status code, suggesting deliberate access restriction or content gating. The page title retrieved from the site reads “Razer Kraken Blog – Обзоры и новости наушников”, linking the site to the Razer Kraken headphone brand.

The domain is explicitly labeled as impersonating the cryptocurrency exchange Kraken, and the overall scam classification is a crypto‑related scheme. Two of ninety‑three VirusTotal scanners flagged the host as malicious, and the domain is listed on a single external blocklist. PhishDestroy has already added the domain to its block list, indicating that at least one anti‑phishing service has observed abusive behavior. Evidence confirms the use of a reputable certificate authority, which may lend superficial credibility, but the combination of a mismatched page title, high‑risk branding, and the presence on blocklists underscores a malicious intent.

The exact nature of the payload or credential‑stealing mechanism remains unknown because the site returns HTTP 403 and has not been publicly scraped. Consequently, defenders should continue to enforce network‑level blocking of the IP address 101.99.76.111 and the domain xn--kr43-onb.com, monitor for any DNS resolution changes, and flag any inbound traffic attempting TLS handshakes to the Let’s Encrypt certificate.