krn46at[.]online

Analysis of krn46at.online shows a domain created on December 09, 2025 that is currently taken offline but was previously used to impersonate the Kraken brand. The page title observed in prior scans reads "Kraken новое официальное зеркало kra47 cc и kra47 at," indicating a Russian‑language claim of an official Kraken mirror. The domain is listed on a single security blocklist and has been specifically blocked by PhishDestroy, reinforcing the assessment of a brand‑impersonation threat. Registration was performed through REGRU‑RU, and the authoritative nameservers are imani.ns.cloudflare.com and jakub.ns.cloudflare.com, pointing to Cloudflare’s DNS service.

The host resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States, a common hosting choice for fast‑changing malicious infrastructure. No SSL certificate is presented for the domain, meaning any HTTP traffic would be unencrypted and more easily intercepted or altered. VirusTotal analysis recorded two detections out of ninety‑three scanning engines, providing limited but corroborating evidence of malicious activity. The threat is classified as a crypto scam, consistent with the impersonation of a cryptocurrency exchange platform.

While the site is presently offline, the infrastructure components—recent registration, Cloudflare DNS, lack of TLS, and blocklist presence—suggest that the domain could be re‑activated for future phishing or credential‑harvesting campaigns targeting Kraken users. Defenders should continue to block krn46at.online at perimeter and endpoint layers, monitor outbound connections to its IP address, and add the domain to internal threat intelligence feeds. Additionally, security teams should watch for newly registered domains with similar naming patterns or Russian‑language titles that reference Kraken, and consider proactive hunting for traffic that matches the observed Cloudflare nameserver configuration.