krakenkrmk[.]com

Analysis of krakenkrmk.com indicates a short‑lived malicious infrastructure designed to impersonate the cryptocurrency exchange Kraken. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to Cloudflare’s network (ASN 13335). DNS resolution returned the IPv6 address 2606:4700:20::ac43:4b65, placing the host in the United States under Cloudflare’s edge infrastructure. The site employed Bootstrap for front‑end layout and presented a page titled “Captcha”, a common technique used to delay automated analysis. The TLS certificate was issued by Google Trust Services under the WE1 root, confirming that HTTPS was correctly configured despite the malicious purpose.

Security‑vendor scanning on VirusTotal recorded detections from 2 of 93 engines, and the domain appears on a single external blocklist maintained by PhishDestroy. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The nameservers aida.ns.cloudflare.com and eoin.ns.cloudflare.com are standard Cloudflare defaults, providing no additional attribution. The site’s primary classification is a crypto‑scam, explicitly targeting Kraken users, and it is currently taken offline. While the available evidence confirms the impersonation intent and the use of reputable hosting, several aspects remain unknown.

No screenshots or page content beyond the title have been captured, so the exact phishing flow cannot be reconstructed. The low detection count suggests that many scanners have not identified the payload, but the presence on a dedicated blocklist and the zero trust score indicate high risk. Defenders should add krakenkrmk.com to internal blocklists, monitor for any future resolution to Cloudflare IP ranges, and enforce strict outbound filtering for domains associated with Kraken brand impersonation.