krakencc[.]at

Analysis of krakencc.at indicates an active infrastructure hosting a cryptocurrency‑related impersonation campaign targeting users of the Kraken exchange. The domain resolves to 172.67.189.192, an address advertised by AS13335 Cloudflare, Inc., and is served through Cloudflare’s authoritative name servers carl.ns.cloudflare.com and luciana.ns.cloudflare.com. TLS is provided by a Let’s Encrypt R13 certificate, and the HTTP response returns status 200. The page title observed in public scans is “Кракен маркет: Вход и актуальная ссылка на маркетплейс”, which aligns with the declared brand target “Kraken” and the classified scam type “Crypto Scam”. VirusTotal records show that one of ninety‑five scanned security vendors flagged the domain, and the site appears on a single external blocklist, currently listed by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The combination of Cloudflare‑based hosting, a valid TLS certificate, and minimal detection suggests a low‑profile operation designed to evade automated filters while exploiting brand trust. Defenders should block the domain and associated IP at network borders, monitor DNS queries for the domain and its Cloudflare name servers, and enforce multi‑factor authentication for Kraken accounts. Analysts should continue periodic re‑scans, as the threat actor may modify content or redirect to additional infrastructure.