kraken-onion-site-com[.]pages[.]dev

This domain, kraken-onion-site-com.pages.dev, poses a high-risk brand impersonation threat targeting users of the Kraken cryptocurrency exchange. The page, titled 'Kraken маркет сайт вход | ссылка на сайт площадка Kraken маркет,' is designed to deceive visitors into entering sensitive login credentials by mimicking the legitimate Kraken platform. The content is presented in Russian, suggesting a targeted campaign aimed at Russian-speaking users, likely to harvest account details for financial fraud or unauthorized access to cryptocurrency wallets.

Analysis indicates the domain was registered on November 21, 2023, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports that 12 out of 95 security vendors detect this domain as malicious, further corroborating its fraudulent nature. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently leverage valid certificates to appear legitimate.

Users who visited this domain should immediately revoke any entered credentials and enable multi-factor authentication on their Kraken accounts. Monitor financial transactions for unauthorized activity and report the incident to their exchange provider. Browser caches and saved passwords associated with this domain should be cleared to prevent accidental re-exposure. Organizations should update their blocklists to include this domain and its resolving IP address (188.114.96.3) to prevent further access.