kraken[.]casino3355[.]cfd

Analysis of kraken.casino3355.cfd shows it was registered on February 21, 2026 through NameCheap, Inc. The domain resolves to the IPv4 address 37.1.221.208, which belongs to ASN 58061 (Scalaxy B.V.) in the Netherlands. The authoritative name servers are keira.ns.cloudflare.com and lee.ns.cloudflare.com, indicating use of Cloudflare DNS. No TLS certificate is presented, so connections are unencrypted. The page title returned from the HTTP response is “Кракен официальный сайт - казино Kraken | Вход и Регистрация”, which combines the Cyrillic word for Kraken with the English brand name, confirming a targeted impersonation of the cryptocurrency exchange Kraken. The site is classified as a crypto‑scam and Google Safe Browsing flags it for social engineering.

VirusTotal recorded 16 detections out of 93 scanned engines, and the domain appears on three independent security blocklists. It has been actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain is currently offline, but the infrastructure footprint remains observable.

Defenders should continue to block the IP 37.1.221.208 and the associated ASN, enforce DNS sink‑hole rules for the two Cloudflare name servers, and ensure that any endpoint security solutions reference the listed blocklists and the Google Safe Browsing feed. Monitoring for new sub‑domains under the same registrar or similar naming patterns is advised, as the attacker may re‑deploy the campaign using fresh domains. Because the site lacked an SSL certificate, any interception of traffic would be trivial, but the lack of encryption also reduces the risk of credential capture via TLS downgrade. Overall, the evidence confirms a high‑risk impersonation of Kraken that warrants continued mitigation and alerting.