kraken9k[.]com

Analysis of the domain kraken9k.com indicates a confirmed case of brand impersonation targeting Google, classified as a tech support scam. The domain was registered on February 13, 2025, through Gname.com Pte. Ltd., and resolved to IP address 104.21.73.129, hosted on Cloudflare's infrastructure (AS13335) in the United States. The SSL certificate is classified as WE1, a low-trust indicator often associated with malicious or deceptive sites. The page title, 'Kraken - ссылка ⭐️ Официальный сайт Кракен ⭐️ Зеркало Кракен ⭐️ Kraken Darknet,' does not align with Google's branding but suggests an attempt to impersonate the Kraken darknet marketplace, which may indicate a secondary or misclassified impersonation vector.

Gridinsoft assigned a trust score of 0/100, and the domain appears on one security blocklist, with PhishDestroy marking it as malicious. VirusTotal reports a single detection from 93 security vendors, a minimal but non-zero indication of suspicion. The domain is currently offline, reducing immediate risk but leaving historical infrastructure data relevant for retrospective analysis.

Defenders should treat this domain as part of a broader impersonation campaign, particularly for tech support scams. While the page content remains unanalyzed, the combination of low-trust SSL, Cloudflare hosting, and brand mismatch warrants blocking at the DNS or proxy level. Monitoring for re-registration or shifts in hosting infrastructure is recommended, as threat actors frequently reuse such domains in subsequent campaigns.