kra35cc[.]shop

This domain, kra35cc.shop, is flagged as a credential theft site designed to impersonate the Kraken darknet marketplace. The page title explicitly advertises itself as 'Slon5.cc — зеркало кракен маркетплейса,' indicating an attempt to deceive users into believing it is an official or legitimate mirror of the Kraken platform. Such sites typically harvest login credentials, payment details, or other sensitive information under false pretenses, often targeting users familiar with darknet marketplaces or cryptocurrency trading platforms. The risk is elevated due to the site's direct impersonation of a known brand, increasing the likelihood of successful deception among unsuspecting visitors. Analysis indicates that kra35cc.shop was registered on March 29, 2026, through Nicenic International Group Co., Limited, a registrar frequently associated with high-risk domains. Despite its recent creation date, the domain has already been detected by 1 out of 95 security vendors on VirusTotal, suggesting early but limited recognition of its malicious intent. The site resolves to the IP address 104.21.95.68 and employs Cloudflare’s infrastructure, including HTTP/3, which is commonly used to obfuscate hosting details and evade detection. The SSL certificate is issued by Google Trust Services, providing a false sense of security to visitors while masking the site’s true nature. The domain appears on one security blocklist and has been referenced in a single AlienVault OTX threat intelligence pulse, further corroborating its malicious classification. Users who visited kra35cc.shop should assume their credentials or other sensitive information may have been compromised. Immediate actions include changing passwords for any accounts accessed while on the site, particularly those tied to cryptocurrency wallets or financial services. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor financial and cryptocurrency transactions for signs of fraudulent activity, and report any suspicious behavior to relevant platforms or authorities. If personal or payment information was entered, consider placing a fraud alert on credit files and reviewing credit reports for unauthorized activity. The domain’s current offline status does not eliminate the risk, as attackers may reuse collected data or reactivate the site under a different domain.