kra26cc[.]net

This domain, kra26cc.net, is flagged as an active brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 188.114.96.3, hosted under Cloudflare, Inc. in Canada. The page title, 'KRA26.cc - Войти krab6.cc,' suggests an attempt to mimic Kraken’s login interface, with the inclusion of Cyrillic text ('Войти' meaning 'Login') potentially targeting Russian-speaking users. The domain is configured with Cloudflare nameservers (brenna.ns.cloudflare.com, ignat.ns.cloudflare.com) and employs Cloudflare Browser Insights and HTTP/3, common in modern phishing infrastructure to evade detection and improve performance. Infrastructure analysis reveals a 301 HTTP status, indicating a redirect, though the destination remains unconfirmed. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which may help the domain appear trustworthy to users. As of July 12, 2026, the domain is listed on one security blocklist (PhishDestroy) and is flagged by 2 of 94 security vendors on VirusTotal, confirming its malicious classification. The Gridinsoft trust score of 0/100 further supports its high-risk status. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Kraken is used. Monitoring for related domains (e.g., krab6.cc) and IP associations (188.114.96.3) is recommended to identify potential lateral movement or additional impersonation attempts. The exact phishing kit or payload remains unanalyzed, so further investigation into the redirect chain or associated files is advised for complete mitigation.