tes-terminal[.]com

Analysis of tes-terminal.com, created on February 21, 2026 and registered through PDR Ltd. d/b/a PublicDomainRegistry.com, shows a clear pattern of brand impersonation targeting the cryptocurrency exchange Kraken. The domain resolves to IP address 186.2.175.37, which is allocated to AS59692 IQWeb FZ-LLC in Belize. Both authoritative name servers are Cloudflare (andy.ns.cloudflare.com and diva.ns.cloudflare.com), indicating use of a reputable DNS provider but not mitigating the malicious intent. No TLS certificate is presented, confirming the site operates without HTTPS encryption.

The only observable content is the page title "Надгробия от KRAKEN: достойная память о родных," a Russian-language phrase that references Kraken and suggests a memorial or commemorative theme, consistent with the reported crypto scam classification. VirusTotal scans report eight out of ninety-three security vendors flagging the domain, reinforcing the suspicion of malicious activity. Independent blocklists used by PhishDestroy, MetaMask, and SEAL have already prohibited the domain, and it appears on three additional security blocklists, further confirming its reputation as a threat. Gridinsoft assigns a trust score of zero out of one hundred, the lowest possible rating, indicating high confidence in its malicious nature.

The site is currently offline, limiting immediate observation of any phishing payload or credential‑harvesting forms; however, the combination of registrar data, hosting location, lack of TLS, flagged vendor detections, and the targeted brand in the title provides sufficient evidence to treat the domain as a confirmed Kraken impersonation used for crypto‑related fraud. Defenders should ensure the domain is added to DNS block lists, enforce outbound filtering to prevent connections to the associated IP, and monitor for re‑registration or re‑appearance of similar Cloudflare‑hosted infrastructure that references Kraken or the same Russian title.