darknet--kraken[.]cc

This domain, darknet--kraken.cc, is flagged for brand impersonation targeting Kraken, a cryptocurrency exchange platform. The site mimics legitimate Kraken infrastructure to deceive users into submitting login credentials, two-factor authentication codes, or other sensitive account details. Such impersonation domains are commonly used in phishing campaigns to harvest authentication data for unauthorized account access, fund theft, or further social engineering attacks against victims. Analysis indicates this domain was specifically crafted to exploit trust in the Kraken brand, likely distributed via email, social media, or malicious advertisements. Infrastructure analysis reveals the domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to IP address 185.226.92.168, located in Turkey, hosted by BIGCORE. At the time of assessment, 16 out of 95 security vendors on VirusTotal flagged this domain as malicious, and it appears on one security blocklist. Notably, the domain lacks an SSL certificate, which is atypical for legitimate financial services and further indicates its fraudulent nature. The page title, matching the domain name, suggests minimal effort to disguise the site as a legitimate Kraken portal. Users who visited darknet--kraken.cc should immediately revoke any active sessions on the legitimate Kraken platform and change their account credentials from a secure device. Enable multi-factor authentication if not already active, and monitor the account for unauthorized transactions or configuration changes. If financial details or recovery codes were entered, contact Kraken support to report the incident and request additional security measures. Review connected devices and applications for signs of compromise, and consider resetting passwords for other services if credential reuse is suspected. Network-level indicators, such as the domain and IP address, should be added to blocklists to prevent further exposure.