omgomgdarknet[.]cc

The domain omgomgdarknet.cc is confirmed to be a site impersonating the cryptocurrency exchange Kraken. This poses a significant risk to users who may mistake it for the legitimate Kraken website, potentially leading to the theft of personal information, login credentials, and financial assets.

Analysis indicates that 9 out of 95 security vendors on VirusTotal flagged omgomgdarknet.cc as a malicious domain. The site was created on March 26, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IP address 188.114.96.3, which is located in Canada and associated with CloudFlare, Inc. The page title 'KRAKEN - ЗЕРКАЛО TOR' suggests an attempt to mimic Kraken's official presence on the Tor network. The SSL certificate is issued by Let's Encrypt, which is a common practice for phishing sites to appear more legitimate. The domain is currently offline and appears on one security blocklist, further indicating its malicious intent.

If a user has visited omgomgdarknet.cc, they should immediately change their Kraken account password and enable two-factor authentication (2FA) if not already active. Users should also monitor their account for any unauthorized transactions and report any suspicious activity to Kraken's support team. Additionally, it is recommended to run a comprehensive security scan on their device to ensure it has not been compromised by any malware or keyloggers.