kra---32----cc[.]sbs

The domain kra---32----cc.sbs has been identified as a brand impersonation threat targeting Kraken, a well-known cryptocurrency exchange platform. Analysis confirms the domain was actively used to mimic Kraken’s official branding, likely to deceive users into disclosing sensitive account credentials or transferring digital assets under false pretenses. The domain is currently offline, but prior activity suggests a deliberate attempt to exploit trust in the Kraken brand for fraudulent purposes. Infrastructure analysis reveals the domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to the IP address 193.105.134.74, hosted by w1n ltd in Sweden, a provider with a history of facilitating malicious infrastructure. The domain was flagged by 14 of 95 security vendors on VirusTotal, indicating broad detection of its fraudulent nature. Additionally, it appeared on one security blocklist, further corroborating its classification as a threat. The SSL certificate, issued by Let’s Encrypt (serial number E7), provided a veneer of legitimacy but did not mitigate the underlying malicious intent. The page title, "Kraken / Кракрен - интернет-маркет электроники и цифровой техники," included Cyrillic characters and misrepresented the platform as an electronics marketplace, a tactic likely designed to evade keyword-based detection while targeting a broader audience. The domain’s current offline status reduces immediate risk, but the infrastructure remains a potential threat if reactivated. Organizations and individuals are advised to block the domain and its associated IP (193.105.134.74) at the network level to prevent accidental access. Users who may have interacted with the domain should immediately revoke any active sessions, reset credentials for Kraken or other cryptocurrency accounts, and monitor for unauthorized transactions. Security teams should treat domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED with heightened scrutiny, particularly those impersonating financial or crypto-related brands. Continuous monitoring for similar domains, including variations of the Kraken brand name, is recommended to mitigate future risks.