slon4-cc-zerkalo[.]ru

The domain slon4-cc-zerkalo.ru has been identified as a brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was specifically designed to mimic Kraken’s official services, likely to deceive users into disclosing credentials or sensitive information under the guise of a "mirror" or "darknet" access point. The domain is currently offline, but prior activity aligns with phishing and fraudulent resource distribution. Infrastructure analysis reveals the domain was created on March 28, 2026, and resolves to the IP address 172.67.163.183. It is flagged by 14 of 95 security vendors on VirusTotal, with detection labels including phishing, fraud, and malicious content. The domain appears on one security blocklist and is referenced in one AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains. Gridinsoft assigns a trust score of 0/100, further confirming its high-risk classification. The page title explicitly references Kraken, Tor-based access, and darknet services, reinforcing its impersonation intent. Given the domain’s current offline status, immediate threats to users are mitigated. However, organizations and security teams should treat this domain as a confirmed malicious indicator. It is recommended to block the domain and associated IP address at the network level, update endpoint protection rules to flag related URLs, and monitor for resurgence under similar naming conventions. Users who may have interacted with this domain should be advised to reset credentials and review account activity for unauthorized transactions. Security teams should correlate this domain with other Kraken-themed phishing campaigns to identify broader attack patterns.