kraken-adres[.]info

The domain kraken-adres.info is currently engaged in brand impersonation targeting Kraken, a major cryptocurrency exchange platform. Analysis confirms this as a high-risk credential theft operation, with the site actively mimicking Kraken's authentication interface to harvest user login credentials. The page title, written in Russian, explicitly advertises a purported 'Kraken mirror' for 'safe entry' into darknet services via Tor, a tactic designed to lure users seeking anonymity or alternative access points. Infrastructure analysis reveals the domain was registered on March 13, 2026, through Dynadot Inc., a registrar frequently observed in malicious campaigns. It resolves to the IP address 172.67.160.12, geolocated to Canada and associated with Cloudflare, Inc., a common proxy service used to obscure hosting origins. The domain is secured with a Let's Encrypt SSL certificate (serial number E7), providing a false sense of legitimacy. Detection metrics indicate moderate but growing awareness: the domain appears on one security blocklist and is flagged by 11 of 95 VirusTotal vendors as malicious. The page title, containing Cyrillic characters and references to darknet access, further corroborates the targeting of Russian-speaking cryptocurrency users. Current status remains active, with no evidence of takedown or mitigation. Users are strongly advised to avoid interacting with kraken-adres.info or any domain purporting to be an official Kraken mirror, particularly those advertising darknet access. Organizations should update blocklists to include this domain and its resolving IP, while end-users should verify the authenticity of any login portal by cross-referencing official Kraken communications. Multi-factor authentication and hardware security keys are recommended to mitigate credential theft risks. Monitoring for similar domains registered through Dynadot or resolving to Cloudflare IPs may help preempt future threats in this campaign.