omgomgomg5j4yrr4mjdv3h5c5xfvxtqqs2in7smi65mjps7vwkmqmtqd[.]cc

This domain, omgomgomg5j4yrr4mjdv3h5c5xfvxtqqs2in7smi65mjps7vwkmqmtqd.cc, is flagged for elevated-risk brand impersonation targeting Kraken, a cryptocurrency exchange platform. The site presented a Russian-language page titled "KRAKEN - САЙТ TOR," suggesting an attempt to deceive users into believing it was the legitimate Tor-based access point for Kraken services. No explicit crypto drainer kit signatures were identified, but the brand impersonation aligns with common phishing tactics used to harvest credentials or distribute malicious payloads. Analysis indicates the domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolved to the IP address 188.114.97.3, hosted on infrastructure associated with CloudFlare in Canada. The SSL certificate was issued by Let's Encrypt (R12). VirusTotal detections reached 10/95 security vendors, and the domain appears on one security blocklist. No Google Safe Browsing (GSB) flags were recorded at the time of assessment. The domain is currently offline, having been taken down following detection by automated threat intelligence systems. While the immediate threat is mitigated, the infrastructure (registrar, hosting provider) may be reused for similar campaigns. Users who accessed the site prior to takedown should assume credential exposure and revoke any active sessions on the legitimate Kraken platform. Monitoring for reuse of the domain or associated IP space is recommended for proactive defense.