kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad0[.]com

This domain, kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad0.com, is flagged for brand impersonation targeting the Kraken cryptocurrency exchange. Analysis indicates the site presents a fake login interface, likely designed to harvest credentials or facilitate unauthorized access to user accounts. The page title references a Tor mirror address (kraken6gf6o4rxewycqwjgfchzgxyfeoj5xafqbfm4vgvyaig2vmxvyd.onion вход через зеркало), suggesting an attempt to mimic legitimate darknet access points used by Kraken for enhanced privacy. Infrastructure analysis reveals the following technical indicators: the domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.96.3, associated with Cloudflare, Inc. in Canada. The domain was created on March 27, 2026, though this date may reflect registry manipulation or backdating. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority that does not inherently validate the legitimacy of the domain’s content. The domain is currently offline, having been taken down following detection and blocking by security mechanisms. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations and individuals are advised to monitor for unauthorized access attempts, reset credentials associated with Kraken or other financial services, and verify the authenticity of any communications or login portals claiming affiliation with the exchange. Continuous vigilance is recommended, as threat actors frequently re-deploy similar infrastructure under new domains.