krakeninvitecode[.]carrd[.]co

krakeninvitecode.carrd.co is currently active and hosts a crypto‑scam that impersonates the Kraken exchange. The domain resolves to 104.18.40.34, an address owned by Cloudflare (AS13335) and located in the United States. Cloudflare’s DNS service is indicated by the authoritative nameservers crystal.ns.cloudflare.com and henrik.ns.cloudflare.com, and the site runs Cloudflare‑provided infrastructure. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming that TLS termination is performed by Cloudflare’s edge.

An HTTP request returns a 403 status code and the page title reported by scanners is “Page not found”, suggesting that the malicious landing page is either hidden or dynamically generated. The domain was registered on 30 April 2015 through MarkMonitor, a registrar commonly used for high‑value brands, which adds credibility to the impersonation attempt. VirusTotal records show that nine out of ninety‑five scanning engines have flagged the domain, indicating a moderate level of detection across the security community. The site is listed on PhishDestroy and appears on one additional security blocklist, reinforcing its malicious classification.

While the exact content of the page has not been captured, the combination of brand targeting, the “Crypto Scam” label, and the presence on multiple blocklists provide sufficient evidence for defensive teams to treat the domain as hostile. Defenders should block traffic to the IP address 104.18.40.34 and to the fully qualified domain name, update URL filtering policies to include krakeninvitecode.carrd.co, and monitor for any related CNAME or sub‑domain registrations that resolve to the same Cloudflare edge. Continuous monitoring of Cloudflare‑hosted domains that reference Kraken or other financial brands is recommended, as attackers frequently recycle this infrastructure for new campaigns.