kraken2trfqodidvlh4aa337onion[.]com

Analysis of kraken2trfqodidvlh4aa337onion.com indicates a high-risk crypto scam impersonating Kraken, a cryptocurrency exchange. The domain was registered on December 2, 2025, through NiceNIC International Group Co., Limited, and is currently offline. Infrastructure reveals it resolved to 185.208.156.66, hosted on AS42624 (Global-Data System IT Corporation, Switzerland), with nameservers ns1.safe-networks.net and ns2.safe-networks.net. No SSL certificate was detected. The page title, kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7instad.onion, suggests an association with Tor-based services, aligning with the domain's .onion-like structure.

Detection data shows the domain was flagged by 16 of 93 security vendors on VirusTotal and appears on one security blocklist. Google Safe Browsing classified it as social engineering. PhishDestroy has blocked the domain, further corroborating its malicious nature. The scam type is explicitly identified as a crypto scam, targeting users of the Kraken platform. Defenders should treat this domain as confirmed malicious.

Block access to 185.208.156.66 and the domain itself at network and endpoint levels. Monitor for related infrastructure, particularly under the safe-networks.net nameserver or AS42624. Given the domain's offline status, no immediate HTTP requests are expected, but historical logs should be reviewed for prior connections. No evidence of a phishing kit or additional payloads is present in the available data, so further forensic analysis of endpoint or proxy logs may be required to determine user exposure. The absence of an SSL certificate and the use of a Tor-associated naming convention suggest an attempt to evade standard web filtering, reinforcing the need for layered defenses.