kra33ccc[.]com

The domain kra33ccc.com has been confirmed as a cryptocurrency credential theft operation targeting users of the Kraken exchange platform. Analysis indicates the site was designed to harvest login credentials, API keys, and two-factor authentication codes under the guise of providing legitimate account access. The domain is currently offline, though its infrastructure remains registered and may reactivate under similar naming conventions. Infrastructure analysis reveals the domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.96.3, which is part of a network known for hosting phishing and fraudulent content. Detection metrics show the domain was flagged by 15 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The site appeared on one security blocklist and employed Cloudflare services, including Browser Insights and HTTP/3, to mask its true origin and evade detection. The page title, 'kra33.сс — Доступ через kra33,' explicitly references Kraken’s branding, reinforcing its intent to impersonate the exchange. The current offline status of kra33ccc.com does not eliminate the risk posed by this campaign. Users who interacted with the domain should immediately revoke any credentials, API keys, or session tokens associated with their Kraken accounts. Organizations are advised to block the IP address 188.114.96.3 at the network perimeter and monitor for domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED with similar naming patterns. Security teams should prioritize reviewing logs for connections to the domain or its associated IP, particularly in environments where cryptocurrency transactions occur. Proactive measures, such as implementing multi-factor authentication and domain-based email filtering, are recommended to mitigate future threats from this actor.