krak44[.]com

The domain krak44.com was observed as part of a brand‑impersonation campaign targeting Kraken. The site is currently offline, but historical data indicate that it was configured to serve a fake exchange page, as indicated by the scam type "Fake Exchange" and the page title "Captcha". The domain was registered on 9 November 2025 through Tucows Domains Inc., and it resolves to the Cloudflare address 172.67.222.108, which belongs to AS13335 Cloudflare, Inc. in the United States. Nameserver records point to cash.ns.cloudflare.com and kallie.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

No SSL certificate was observed for the host, meaning HTTPS was not available at the time of capture. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent. The risk level is listed as elevated.

Because the site is no longer reachable, active probing is not possible, and the exact content of the landing page cannot be verified beyond the captured title. Defenders should continue to monitor DNS queries for the domain and its associated IP address, enforce blocklists that include krak44.com, and apply URL filtering rules that deny traffic to the Cloudflare IP range used by the domain. Incident response teams should also consider the possibility of related domains registered through the same registrar or using the same nameservers, and incorporate these indicators into threat‑intel feeds. Ongoing vigilance is recommended to detect any re‑registration attempts or similar impersonation campaigns targeting the Kraken brand.