thenesya[.]com

Analysis of the domain thenesya.com indicates it was actively impersonating the Kraken cryptocurrency exchange platform. The domain was registered on July 18, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolved to the IP address 198.18.2.58 and utilized nameservers ns1.armadns.com and ns2.armadns.com, a configuration commonly observed in low-reputation hosting environments. No SSL certificate was present, increasing the risk of unencrypted data transmission.

The page title, 'Кракен ссылка pw - Все зеркала Кракен Фильм 2025 в одном месте - проверено и безопасно,' explicitly references Kraken alongside terms suggesting mirror sites, a tactic used to deceive users into accessing fraudulent exchange portals. This aligns with the classified scam type of 'Fake Exchange' in available intelligence. Detection metrics at the time of assessment showed minimal coverage, with only 2 of 95 security vendors on VirusTotal flagging the domain as malicious, and a single appearance on security blocklists, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, further indicating high risk.

The domain was taken offline by the time of this report, though historical resolution and registration details remain relevant for defensive measures. Defenders should prioritize monitoring for re-registration under the same or similar names, particularly those using the same registrar or nameserver infrastructure. Given the targeted brand and the use of Cyrillic text in the page title, the campaign likely focused on Russian-speaking users. No evidence links this domain to broader phishing kits or additional threat actor infrastructure at this time.