kraken2trfqodidvlh4a337cpzfrhdlfldhve5nf7njhumwr7instad-onion[.]com

This domain, registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, is actively impersonating the Kraken cryptocurrency exchange. Analysis indicates a high-risk brand impersonation threat, with the page title explicitly displaying 'KRAKEN' and the domain structure incorporating the brand name. The site resolves to IP 188.114.96.3, hosted on Cloudflare infrastructure (ASN location: CA), and employs Cloudflare nameservers (miguel.ns.cloudflare.com, raquel.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), and the site returns an HTTP 301 redirect, suggesting it may be part of a larger redirection chain or infrastructure designed to evade detection. As of July 12, 2026, the domain remains active and is flagged by one security blocklist (PhishDestroy). Nineteen of 94 security vendors on VirusTotal have detected this domain as malicious, though the specific nature of the threat (e.g., credential harvesting, malware distribution, or fraudulent transactions) is not yet confirmed. The use of Cloudflare Browser Insights and HTTP/3 further indicates an attempt to leverage modern web technologies for obfuscation or performance optimization, common in phishing campaigns targeting financial services. Defenders should treat this domain as a confirmed brand impersonation threat. Immediate actions include blocking the domain and associated IP (188.114.96.3) at the network level, monitoring for related domains registered through the same registrar, and alerting users to potential Kraken-themed phishing attempts. Further analysis of the redirect target and any associated payloads is recommended to determine the full scope of the campaign.