kra-market[.]cc

Analysis of the domain kra-market.cc indicates a confirmed phishing campaign targeting users of the Kraken cryptocurrency exchange. Registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 172.67.131.135, hosted on infrastructure associated with Cloudflare, Inc. in Canada. The page title, presented in Cyrillic and English, explicitly references 'Kraken darknet' and a 'secure trading platform,' aligning with known brand impersonation tactics targeting Kraken users. Infrastructure review reveals the use of expired nameservers (expired-ns1.niceisp.com and expired-ns2.niceisp.com), a pattern often observed in transient phishing domains. The domain is flagged by 16 of 94 security vendors on VirusTotal, and AlienVault OTX lists it in 21 threat intelligence pulses, further corroborating its malicious classification. Detection by PhishDestroy and a Gridinsoft trust score of 0/100 reinforce the high-risk assessment. The site remains active as of July 12, 2026, serving a 200 HTTP status and employing an SSL certificate issued by Google Trust Services (WE1). While the exact content and functionality of the site have not been directly analysed, the combination of brand impersonation, cryptocurrency-themed messaging, and detection by multiple security vendors confirms its role in a phishing operation. Defenders are advised to block the domain and its resolving IP at the network level, monitor for credential submission attempts, and alert users to the presence of this campaign.