krak3n[.]site

The domain krak3n.site is currently active and hosts a brand impersonation campaign targeting the cryptocurrency exchange Kraken. Infrastructure analysis shows the domain was registered on April 21, 2026 through NameSilo, LLC and is served via Cloudflare, using the nameservers olivia.ns.cloudflare.com and peyton.ns.cloudflare.com. The domain resolves to IP 172.67.184.252, which is located in Canada and belongs to Cloudflare, Inc. The site presents a TLS certificate issued by Google Trust Services (WE1), indicating a valid HTTPS configuration despite malicious intent. HTTP requests return a 403 status code, and the only visible page title is "Just a moment...", suggesting the content is being hidden or redirected. Threat intelligence indicates the site is listed on one security blocklist and has been blocked by PhishDestroy. It appears in a single AlienVault OTX pulse and received a Gridinsoft trust score of 0/100, reflecting a high confidence of malicious behavior. VirusTotal analysis shows one out of ninety-four scanning engines flagged the domain, reinforcing the suspicion. While the exact payload or credential‑stealing mechanisms have not been observed, the combination of brand impersonation, recent registration, Cloudflare hosting, and low trust scores signals a high‑risk indicator. Defenders should immediately add krak3n.site to DNS blocklists or sinkhole configurations, monitor for DNS queries to the associated IP address, and enforce outbound filtering for traffic to the domain. Continuous threat‑intel correlation is recommended to detect any emerging variants that reuse the same naming pattern or infrastructure.