kraken1[.]su

Analysis of the domain kraken1.su indicates a brand impersonation campaign targeting Kraken, a cryptocurrency exchange platform. The domain was registered on February 21, 2026, through the registrar BEGET-SU and currently resolves to the IP address 104.21.47.198, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. The domain has been flagged by 3 of 93 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy, suggesting elevated risk associated with crypto scam activity. Infrastructure analysis reveals the domain lacks an SSL certificate, which is atypical for legitimate financial platforms and increases the likelihood of credential interception.

The nameservers, keenan.ns.cloudflare.com and sunny.ns.cloudflare.com, are consistent with Cloudflare's DNS services, a common choice for both legitimate and malicious actors seeking to obfuscate hosting origins. The page title, 'KRAKEN - Официальный сайт и зеркала маркетплейса Кракен 2026,' explicitly impersonates Kraken, using Cyrillic text to target Russian-speaking users and reinforce the illusion of authenticity. At the time of this report, the domain has been taken offline, though its prior active status and detection by security vendors warrant continued monitoring.

Defenders should treat any residual DNS records or cached pages as malicious and update blocklists accordingly. The absence of additional telemetry, such as Safe Browsing or OTX reports, limits further attribution, but the combination of registrar, hosting provider, and detection counts supports classification as a crypto-focused phishing domain. Organizations are advised to verify domain authenticity through official Kraken channels and implement network-level blocking for kraken1.su and associated IPs.