krakemarket[.]cc

Analysis of krakemarket.cc conducted on July 24, 2026 indicates the domain is actively employed for brand impersonation of the cryptocurrency exchange Kraken. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is delegated to the Cloudflare name servers andronicus.ns.cloudflare.com and gail.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is attributed to AS13335 Cloudflare, Inc. and geolocated to the United States. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 identifier, and the HTTP response code is 200, confirming that the server is reachable.

Observed web technologies include Cloudflare’s edge services, HTTP/3 support, and Yandex.Metrika analytics, suggesting an attempt to gather visitor metrics while leveraging Cloudflare’s performance and protection features. Reputation checks show the domain appears on a single security blocklist and receives a Gridinsoft trust score of 0 out of 100. VirusTotal analysis registers five positive detections out of ninety‑three scanning engines, and the domain is listed as blocked by the PhishDestroy feed. The page title returned by the HTTP request is exactly “krakemarket.cc/”, matching the domain name and providing no additional context.

While the presence of a brand‑impersonation label and the low trust scores strongly point to malicious intent, the publicly available content has not been fully dissected; no login form or credential‑harvesting page has been captured. Consequently, the exact phishing workflow remains uncertain. Defenders should treat krakemarket.cc as a high‑risk indicator and consider immediate mitigation actions, including adding the domain to URL filtering lists, enforcing DNS‑level blocking, and monitoring for related C2 infrastructure. Ongoing telemetry collection is advised to capture any future payloads or redirects that may emerge from this infrastructure.