kra4[.]org

Analysis of kra4.org confirms its classification as a crypto scam site targeting Kraken users, based on observable domain infrastructure and detection data. The domain was registered on November 16, 2025, through Gname.com Pte. Ltd., and was taken offline by the time of this report. It resolved to IP 172.67.201.59, hosted on Cloudflare's network (AS13335), a common pattern for phishing domains leveraging Cloudflare's proxy services to obscure origin servers. The domain used Cloudflare nameservers (ariadne.ns.cloudflare.com, viddy.ns.cloudflare.com) and lacked an SSL certificate, increasing exposure to interception risks.

The page title 'KRAKEN' directly matches the targeted brand, Kraken, a cryptocurrency exchange, aligning with the scam type labeled as 'Crypto Scam' in available intelligence. Detection coverage was limited but conclusive: one security vendor flagged the domain on VirusTotal, and it appeared on a single security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. No additional details about the phishing kit, payload delivery mechanisms, or victim interaction patterns are available at this time, as the site is offline and no historical captures or forensic artifacts were provided.

Defenders should treat kra4.org as a confirmed threat. Recommended actions include blocking the domain and associated IP (172.67.201.59) at perimeter security controls, updating detection rules to include the page title 'KRAKEN' as a potential indicator, and monitoring for related domains registered through Gname.com or using Cloudflare nameservers with similar naming conventions. Given the domain's recent creation and offline status, further monitoring of the registrar and hosting infrastructure is advised to identify potential resurgence or related campaigns.