kraktag[.]ink

Analysis of the domain kraktag.ink indicates a high‑risk brand‑impersonation campaign targeting the Krak financial application. The domain was registered on May 09, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑hosted IP address 104.21.67.196, which is geolocated to Canada. The site presents a page title identical to the legitimate Krak app, "Krak | Global Money App | Spend, Send & Grow | Krak," suggesting intentional brand mimicry to deceive users.

Infrastructure inspection shows the domain is served behind Cloudflare’s network, using Google Trust Services / WE1 for its SSL certificate, and the authoritative nameservers are uma.ns.cloudflare.com and thaddeus.ns.cloudflare.com. The site returns an HTTP 301 redirect, a behavior commonly leveraged in credential‑harvesting pages to forward victims to malicious payloads. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on one security blocklist, and PhishDestroy has already blocked it.

Threat intelligence corroborates the malicious nature of the domain. It appears in a single AlienVault OTX pulse, and VirusTotal reports that one of ninety‑five scanned security vendors flagged the domain as malicious. These independent detections reinforce the likelihood that kraktag.ink is being used to harvest credentials or financial information under the guise of the Krak brand.

While the observable indicators confirm active abuse, the precise phishing kit, command‑and‑control infrastructure, or victim count remain undisclosed. Defenders should prioritize blocking the domain at network perimeter devices and updating URL filtering policies to include kraktag.ink. Continuous monitoring of related Cloudflare‑hosted IP ranges and rapid sharing of any new indicators with threat‑sharing communities are recommended to curb further propagation of this impersonation campaign.