kra--30---cc[.]sbs

The domain kra--30---cc.sbs was identified as a brand impersonation threat targeting the cryptocurrency exchange Kraken. This domain is currently offline, but during its active period it posed a significant risk to users by mimicking the legitimate Kraken platform to potentially steal credentials or financial information. The page title read "Kraken / Кракрен - интернет-маркет электроники и цифровой техники," which is a clear attempt to deceive visitors into believing they were on an official Kraken site.

Technical analysis reveals that kra--30---cc.sbs was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on March 29, 2026. It resolves to IP address 193.105.134.74 and uses an SSL certificate issued by Let's Encrypt (E7), which is common among phishing sites due to its free and automated issuance. VirusTotal flagged the domain with 14 out of 95 security vendors marking it as malicious, and it appears on one security blocklist. Additionally, AlienVault OTX includes it in one threat intelligence pulse, indicating community awareness. Despite these indicators, the domain had a low trust score and was not widely blocklisted, allowing it to operate for a period.

Although kra--30---cc.sbs is now offline, users should remain vigilant. Anyone who may have visited the site should change their Kraken account credentials immediately and enable two-factor authentication. It is also advisable to monitor financial accounts for unauthorized activity. PhishDestroy recommends blocking this domain at the network level and reporting any similar domains to relevant threat intelligence platforms. Users should always verify URLs carefully, especially when directed to cryptocurrency exchanges, and avoid clicking on links from unsolicited messages.