kraken-ssilka[.]info

This domain, kraken-ssilka.info, is identified as a high-risk brand impersonation threat targeting the Kraken cryptocurrency exchange. Analysis indicates the site employs deceptive design elements and redirects to kra43.cc, a known phishing endpoint, to harvest user credentials and financial data. No specific drainer kit signatures were confirmed, but the infrastructure aligns with common cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 172.67.207.117. It is flagged by 14 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists, including MetaMask, SEAL, and PhishDestroy. No Google Safe Browsing (GSB) records were available at the time of analysis, but the domain's registration and hosting patterns suggest deliberate evasion of detection mechanisms. The domain is currently offline, likely due to takedown actions or infrastructure suspension. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations are advised to monitor for related indicators, including the IP 172.67.207.117 and the redirect endpoint kra43.cc, and update blocklists to prevent future exposure. Users should verify domain authenticity before entering credentials on any cryptocurrency-related platform.