kra4[.]pro

The domain kra4.pro was observed in the wild targeting the cryptocurrency exchange brand Kraken. The site presented the page title “KRAKEN”, aligning with the declared brand target, and was classified as a crypto‑scam. Technical resolution shows the domain resolves to IP address 172.67.201.59, which is advertised as a Cloudflare edge node (AS13335, United States). The authoritative nameservers listed are dalary.ns.cloudflare.com and nico.ns.cloudflare.com, confirming that the domain leverages Cloudflare’s DNS service.

No TLS certificate was detected for the domain, indicating that HTTPS was not configured at the time of analysis. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal scans reported a single positive detection out of ninety‑three contributing security vendors, reinforcing the suspicion of malicious intent. The site’s current status is offline, and no additional content or HTTP response headers have been captured, leaving the exact phishing payload or credential‑harvesting mechanisms unverified.

Nonetheless, the convergence of a brand‑specific page title, the crypto‑scam classification, the presence on a blocklist, and a positive vendor detection constitute sufficient evidence for classification as a confirmed malicious resource. Defenders should continue to block the domain and its associated IP address at network perimeters, update URL filtering and threat intelligence feeds with the observed indicators, and monitor for any re‑registration attempts that reuse the same name servers or IP range. Continued observation of the Cloudflare‑hosted IP space is recommended, as adversaries frequently rotate subdomains under the same infrastructure. Because the site is no longer reachable, content‑level indicators such as login forms, malicious scripts, or redirection URLs could not be captured, and therefore the full scope of the phishing kit remains unknown.