kra40mp[.]cc

This domain is flagged for hosting a generic phishing scheme targeting users of the Hydra darknet market. Analysis indicates the site presents itself as an official mirror or login portal, as evidenced by the page title "Кракен ссылка - зеркало и вход на официальный сайт," which translates to "Kraken link - mirror and login to the official site." The threat type is classified as brand impersonation with phishing intent, likely designed to harvest credentials or distribute malicious payloads under the guise of a trusted marketplace. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.219.97, a Cloudflare-protected endpoint. It is registered through NiceNIC International Group Co., Limited, with a creation date of February 21, 2026, suggesting either a typo-squatting attempt or a preemptive registration for malicious use. The domain holds a Gridinsoft trust score of 0/100 and is flagged by 6 out of 95 security vendors on VirusTotal. It appears on two security blocklists, including PhishDestroy and OISD. The SSL certificate is issued by Google Trust Services, and the site employs technologies such as jsDelivr, HSTS, Cloudflare, and HTTP/3, which are commonly used to obfuscate malicious activity behind legitimate infrastructure. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP (172.67.219.97) at the network perimeter. Organizations should update security blocklists to include kra40mp.cc and monitor for any attempts to access the domain internally. End users should be advised to verify the authenticity of any login portal claiming affiliation with Hydra or Kraken, particularly those accessed via unofficial channels. Given the domain's current offline status, continuous monitoring is recommended to detect potential re-emergence or related domains registered through the same registrar or resolving to the same IP infrastructure.