kraken--ssylka[.]cc

On July 23, 2026, threat analysts examined the domain kraken--ssylka.cc, which was registered on February 21, 2026 through NiceNIC International Group Co., Limited. The site presents a page title identical to the domain name and claims to impersonate the cryptocurrency exchange Kraken, categorised as a crypto‑scam. Technical fingerprinting identified an Ubuntu operating system serving content via Nginx, and the domain resolves to IP address 193.124.113.223, located in Russia and associated with AS48347 JSC Mediasoft ekspert. No SSL certificate was observed, indicating the service operated over plain HTTP, a characteristic often exploited in credential‑stealing campaigns.

The domain’s authoritative nameservers are a.dnspod.com, b.dnspod.com, and c.dnspod.com, a common configuration for rapidly provisioned malicious infrastructure. VirusTotal scans recorded 14 detections out of 95 security vendors, reflecting moderate consensus among scanners that the domain is malicious. It appears on a single external blocklist and has been specifically blocked by PhishDestroy, confirming that at least one dedicated anti‑phishing service has taken protective action.

The site is currently offline, which may be a temporary takedown or an evasion tactic; however, the underlying infrastructure—IP, hosting provider, and nameserver pattern—remains observable and could be reused for future campaigns. Defenders should add kraken--ssylka.cc and its resolved IP to network denylists, enforce TLS inspection to detect unencrypted traffic to the host, and monitor for new domains registering with similar naming conventions or using the same DNS provider. Continuous re‑evaluation of the IP block and rapid sharing of indicators of compromise with threat‑sharing platforms are recommended to mitigate potential re‑use of this infrastructure.