megaonion[.]cc

The domain megaonion.cc has been identified as a confirmed phishing site that impersonates the Kraken brand. As of July 12, 2026, the domain remains active and is associated with high-risk activities aimed at deceiving users into providing sensitive information. The page title on the website is 'Как работает ссылка Kraken Onion', which translates to 'How the Kraken Onion link works', further indicating its intent to mislead users regarding the legitimacy of the service offered.

The domain resolves to the IP address 188.114.96.3, which is linked to known malicious activities. It has been flagged in 22 threat intelligence pulses on AlienVault OTX, signaling significant awareness within the cybersecurity community. Additionally, VirusTotal reports that 15 out of 95 security vendors have flagged this domain, further corroborating its malicious status. The domain is also listed on two security blocklists and is blocked by PhishDestroy and BLP-Malware, demonstrating active efforts to contain its proliferation.

The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 26, 2026, and employs technologies such as Cloudflare Browser Insights and HTTP/3, which are commonly used to enhance performance but can also obscure the true nature of malicious activities. The SSL certificate utilized is issued by Let's Encrypt, which, while typically associated with legitimate sites, has also been exploited by malicious actors to lend credibility to their phishing attempts.

Infrastructure analysis reveals that the Gridinsoft trust score for megaonion.cc is 0 out of 100, indicating an extremely high risk associated with the domain. Defenders should monitor this domain closely and take necessary measures to block access to it in order to protect potential victims from falling prey to this impersonation scheme.