kradispute[.]cc

Analysis of kradispute.cc, first observed on February 23, 2026, indicates that the domain is being used for a cryptocurrency‑related scam that impersonates the Kraken exchange. The site’s HTML title, “Диспут на Кракен – как открыть, закрыть и выиграть”, directly references Kraken dispute processes, suggesting an attempt to lure Russian‑speaking users into fraudulent actions. The domain resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Hosting on Cloudflare provides anonymity and rapid deployment, a pattern common to malicious infrastructure.

No TLS certificate was observed, meaning the site operated without HTTPS, which is atypical for legitimate financial services and further lowers trust. Registration information shows the domain was created on 23 February 2026 via NiceNIC International Group Co., Limited, a registrar known to host both legitimate and abusive domains. The domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑intelligence feeds have identified it as malicious. Google Safe Browsing classifies the site as “social engineering”, reinforcing the phishing nature of the content.

VirusTotal scans returned 12 detections out of 93 antivirus engines, indicating a moderate level of consensus among security products that the domain is malicious. The primary threat actor appears to be targeting users of the Kraken platform, likely attempting to harvest login credentials or persuade victims to transfer cryptocurrency under the guise of dispute resolution. While the page content has not been publicly captured, the combination of the Russian‑language title, the impersonation of Kraken, and the classification as a crypto scam provide a clear indication of intent.