kra247[.]cc

The domain kra247.cc was registered through Dynadot Inc on March 28, 2026 and remains active as of the report date (July 12, 2026). The site presents a page titled "KRAKEN официальный сайт kra247.cc KRAKEN MARKET ONION", clearly mimicking the official Kraken brand. The threat is classified as a high‑risk brand‑impersonation campaign targeting Kraken users. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. and is geolocated in Canada. Authoritative nameservers are keenan.ns.cloudflare.com and sunny.ns.cloudflare.com. HTTP requests return a 200 status code and the site serves a valid SSL certificate issued by Google Trust Services (WE1). Gridinsoft assigns a trust score of 0/100, and VirusTotal records a single positive detection out of 95 scanned security vendors. The domain is listed on one public security blocklist and has been blocked by PhishDestroy. AlienVault OTX references the domain in a single threat‑intelligence pulse. Current intelligence does not disclose the specific payload or credential‑capture mechanism employed by the site; the visible content is limited to the forged brand banner and market‑related text. No additional C2 endpoints, download links, or obfuscated scripts have been observed in the initial page snapshot. Consequently, the exact scope of the malicious activity—whether it is limited to credential phishing or includes malware distribution—remains uncertain. Defenders should immediately add kra247.cc to network‑level deny lists and configure DNS filtering to block resolution. Endpoint protection policies should flag any TLS connections to the domain, even though the certificate chain appears valid. Users of Kraken services should be warned about the counterfeit site and instructed to verify URLs before entering credentials. Continuous monitoring of the associated IP address and Cloudflare nameservers is advised to detect any future infrastructure changes.