mc[.]krakenlog[.]com

This domain, mc.krakenlog.com, is flagged for brand impersonation targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was registered on May 22, 2025, through HOSTINGER operations, UAB, and currently resolves to the IP address 54.37.197.41, hosted on OVH SAS infrastructure (AS16276) in Germany. The domain utilizes Cloudflare nameservers (addyson.ns.cloudflare.com and duke.ns.cloudflare.com) and employs a Let's Encrypt SSL certificate (serial number E8), suggesting an attempt to appear legitimate through encrypted connections. The page title, 'Email marketing platform | Mailercloud,' does not align with the expected content for a cryptocurrency exchange, which may indicate an effort to mislead automated detection systems or obfuscate the domain's true purpose. As of the report date, the domain appears on one security blocklist and is flagged by 3 of 93 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in the available intelligence.

Gridinsoft assigns a trust score of 0/100, reinforcing the elevated risk classification. The domain has been taken offline, likely in response to detection by security vendors such as PhishDestroy. The scam type is classified as a crypto scam, though the exact mechanics—whether credential harvesting, fake giveaways, or wallet drainers—are not confirmed due to the lack of page content analysis. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels.

The use of Cloudflare nameservers and OVH hosting is consistent with patterns observed in other phishing campaigns, where bulletproof or low-cost hosting providers are leveraged to evade takedowns. Given the domain's offline status, monitoring for re-activation or related infrastructure (e.g., newly registered domains under the same registrar or IP range) is recommended.