xn--mgmrket9-px0d[.]com

This domain, xn--mgmrket9-px0d.com (IDN: 'mɡmrket-px0d.com'), is actively impersonating the Kraken cryptocurrency exchange as part of a confirmed crypto scam operation. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain resolves to IP address 101.99.76.111, hosted on AS45839 (Shinjiru Technology Sdn Bhd) in the Netherlands. Infrastructure analysis reveals the use of nameservers ns0.1984.is, ns1.1984.is, ns1.1984hosting.com, ns2.1984.is, and ns2.1984hosting.com, which are associated with privacy-focused hosting services often exploited for malicious activity. The site's page title, 'kraken7svj75qvyeauw4sbe7ssiqypcpfwlppieqzfiqdpj76alksgad.onion', directly references a Tor-based Kraken impersonation, reinforcing its fraudulent intent. Technologies detected include Node.js, Ubuntu, Nginx, and Express, suggesting a custom-built phishing framework rather than a widely distributed kit. The domain currently returns an HTTP 403 status, which may indicate either a restricted access mechanism or an attempt to evade automated crawling while maintaining backend functionality. As of July 13, 2026, the domain is flagged by two of 93 security vendors on VirusTotal and appears on at least one security blocklist. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. The SSL certificate, issued by Let's Encrypt (R13), provides no inherent legitimacy, as such certificates are routinely abused in phishing infrastructure. Defenders should treat this domain as high-risk and prioritize blocking at the DNS, IP, and certificate levels. Given its association with a Tor-based impersonation of a major cryptocurrency exchange, the site is likely designed to harvest credentials or facilitate unauthorized fund transfers. No legitimate use case for this domain has been identified, and its continued operation suggests ongoing malicious activity. Further monitoring of associated infrastructure, particularly the linked .