kraken-tor-darknet[.]info

The domain kraken-tor-darknet.info has been identified as a high-risk brand impersonation site targeting Kraken. Analysis indicates that the domain resolves to the IP address 172.67.206.135, which is located in the United States and is part of Cloudflare, Inc.'s network (AS13335). The domain was registered through Dynadot Inc on May 07, 2026, and currently uses the nameservers amos.ns.cloudflare.com and kay.ns.cloudflare.com. The site's page title, 'Официальное зеркало Kraken в браузере Tor для безопасного входа 2026,' suggests it is attempting to impersonate an official Kraken mirror for Tor browser users, promoting itself as a secure entry point. However, the domain is flagged by the security solution PhishDestroy and appears on one security blocklist, indicating its malicious intent. The SSL certificate is issued by Let's Encrypt, which is common for both legitimate and phishing sites. While 2 of 91 security vendors have flagged this domain, the low detection rate does not necessarily imply safety, as many phishing sites are designed to evade detection. Defenders should block this domain and warn users to avoid visiting it, as it poses a significant risk of credential theft or other malicious activities. The exact content of the site has not been fully analyzed, but the title and registration details strongly suggest a brand impersonation scam.