kra35[.]xyz

Analysis indicates that the domain kra35.xyz was registered on 21 February 2026 through Gname.com Pte. Ltd. and immediately pointed to the Cloudflare edge address 188.114.96.3, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. The authoritative name servers are kirk.ns.cloudflare.com and lilith.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate was observed; the service responded without HTTPS, and the site is currently taken offline. The domain appears on a single security blocklist and has been flagged by the PhishDestroy feed. VirusTotal reports that four of ninety‑three scanned scanners classified the host as malicious, indicating a modest but non‑trivial detection rate.

Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The page title returned by the server is the long string “kraken5aszn4iosa2z4djujetvurbc6x3ef2pbr4igzaifecdufe2iyd.onion”, which does not resolve to a conventional HTML title and suggests an attempt to reference a hidden‑service identifier. Brand‑targeting intelligence labels the activity as a “brand impersonation” of the cryptocurrency exchange Kraken, and the overall scam type is recorded as a crypto‑scam. No additional content, such as login forms or payment pages, has been captured, so the exact payload remains unknown. The lack of an SSL certificate and the reliance on Cloudflare’s free DNS services are typical of low‑cost malicious infrastructure.

Defenders should continue to block kra35.xyz at perimeter filters, update any URL‑allow lists to include the domain in deny rules, and monitor for future resolution to the same IP address or Cloudflare name servers. Given the low trust score and the presence on a blocklist, automated threat‑intel feeds should treat any traffic to this host as suspicious. Continuous re‑scanning on VirusTotal or similar platforms is advisable to capture any changes in detection ratios.