xn--ra2-6ua[.]cc

This domain, xn--ra2-6ua.cc, was identified as a brand impersonation phishing site targeting users of the Kraken cryptocurrency exchange. The site masqueraded as a legitimate platform, potentially tricking visitors into disclosing sensitive credentials, financial details, or installing malicious software under the guise of Kraken’s services. Analysis of the page title, "Kraken Audio — Премиальные наушники," suggests an attempt to deceive users by leveraging a well-known brand name while presenting unrelated content, a common tactic in phishing operations to evade initial suspicion.

Infrastructure analysis reveals the domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to the IP address 172.67.195.61 and employed technologies such as Node.js, Express, and Cloudflare, including HTTP/3 for enhanced performance and obfuscation. Security vendor detections on VirusTotal flagged the domain as malicious, with 12 out of 95 engines identifying it as a threat. Additionally, the domain appeared on one security blocklist, and a Gridinsoft trust score of 0/100 further corroborates its malicious nature.

Users who visited xn--ra2-6ua.cc should assume potential exposure to credential harvesting or malware distribution. Immediate actions include revoking any credentials entered on the site, scanning devices for malware using updated security tools, and monitoring financial accounts for unauthorized transactions. If cryptocurrency wallet details were shared, transferring assets to a new wallet is strongly recommended. Organizations should update internal blocklists to prevent future access and educate users on recognizing brand impersonation tactics, particularly those involving homoglyph domains or unrelated page content.