kraken24[.]buzz

This domain, kraken24.buzz, poses a targeted brand impersonation threat against Kraken, a major cryptocurrency exchange platform. Analysis of the page title, ((KRAKEN)) (TOR) - Рабочие зеркала Вход на ((Kraken)) на сегодня, indicates an attempt to deceive users into accessing fraudulent login portals by mimicking legitimate Kraken services. The domain specifically advertises "working mirrors" for Kraken, suggesting an intent to harvest credentials or distribute malicious payloads under the guise of providing alternative access points to the genuine exchange. Infrastructure analysis reveals concrete indicators of malicious activity. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.97.3. It appears on one security blocklist and is flagged by 2 out of 95 security vendors on VirusTotal. The domain employs Cloudflare for hosting and utilizes an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Additional technologies detected include HSTS, Cloudflare Browser Insights, and HTTP/3, which are consistent with modern phishing infrastructure designed to evade detection. Users who have visited kraken24.buzz or interacted with its content should take immediate action to mitigate potential risks. First, any credentials entered on this domain should be considered compromised and must be changed immediately on the legitimate Kraken platform. Users should also monitor their cryptocurrency wallets and accounts for unauthorized transactions. It is recommended to conduct a full system scan using updated security tools to detect any potential malware or backdoors. Additionally, users should report the domain to their security providers and consider enabling multi-factor authentication on all critical accounts to prevent future unauthorized access.