kraken-link-onion[.]org

Analysis of the domain kraken-link-onion.org indicates it was a brand-impersonation phishing site targeting users of the Kraken cryptocurrency exchange. The domain was registered on September 15, 2025, through Fewmoretaps OU operating as Trustname.com. Infrastructure analysis reveals Cloudflare hosting, with nameservers dax.ns.cloudflare.com and magdalena.ns.cloudflare.com, and resolution to the IP address 188.114.96.3, located in Canada under Cloudflare, Inc. The SSL certificate was issued by Google Trust Services, specifically the WE1 intermediate, which is consistent with legitimate sites but does not preclude malicious use. Detection data from July 2026 shows limited but targeted flagging: two of ninety-four security vendors on VirusTotal identified the domain as malicious, and it appeared on one security blocklist, specifically PhishDestroy.

The Gridinsoft trust score for the domain was 0 out of 100, reflecting high-risk classification. The page title, 'slons7.cc,' does not match the domain name or the Kraken brand, which may indicate redirection or cloaking behavior, though the exact content and functionality of the site remain unconfirmed as the domain is currently offline. Technologies detected on the domain include Yandex.Metrika, a web analytics service, and HTTP/3, a protocol often used for performance optimization. The use of Cloudflare suggests attempts to obscure hosting origin and evade takedowns.

Defenders should treat this domain as part of a Kraken-branded phishing campaign, particularly given its registration details, detection history, and association with a known registrar used in previous phishing operations. Network security teams are advised to block the domain and IP, monitor for related infrastructure, and alert users to potential cryptocurrency-themed phishing risks. Further investigation into the 'slons7.cc' reference may reveal additional linked domains or redirection chains.