nova24web[.]cfd

The domain nova24web.cfd is identified as a brand impersonation threat targeting Kraken, a legitimate cryptocurrency exchange platform. Analysis indicates the site masquerades as a darknet marketplace, as evidenced by its page title 'Kraken Darknet Marketplace | Рабочая ссылка 2025.' This domain is currently offline, but its infrastructure and historical activity suggest malicious intent aimed at deceiving users into disclosing sensitive credentials or conducting fraudulent transactions. Technical indicators confirm elevated risk levels. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with suspicious registrations. It resolves to the IP address 188.114.97.3, which is linked to Cloudflare infrastructure, a common obfuscation tactic used by threat actors. VirusTotal reports that 2 of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. The SSL certificate, issued by SSL Corporation under Cloudflare TLS Issuing ECC CA 3, does not mitigate the risk, as encrypted connections are routinely exploited in phishing campaigns to lend false legitimacy. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure changes by the threat actor. However, the risk of re-emergence remains. Organizations and users are advised to block this domain and its associated IP address at the network level. Security teams should monitor for similar impersonation attempts targeting Kraken or other financial platforms, particularly those using Cloudflare-hosted infrastructure. End-users should verify domain authenticity through official channels before engaging with any cryptocurrency-related sites, especially those advertising darknet services or non-standard access links.