krakenmarketonion[.]com

The domain krakenmarketonion.com was registered on March 27 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the IP address 172.67.159.47, which is hosted in Canada behind a CDN service. The site presents a valid TLS certificate issued by a public certificate authority and returns an HTTP 302 status code, indicating an immediate redirect. The page title returned by the server contains the brand name Kraken followed by Cyrillic text, confirming a deliberate attempt to impersonate the Kraken brand. Infrastructure analysis shows the use of modern HTTP/3 protocol and CDN‑based browser insights, and authoritative nameservers are listed as celine.ns.cloudflare.com and neil.ns.cloudflare.com. Threat intelligence sources report that the domain appears on a single security blocklist, has been registered in an AlienVault OTX pulse, and is actively blocked by a known phishing mitigation service. VirusTotal scans show five of ninety‑one security vendors flag the domain, while a Gridinsoft trust score of 0 out of 100 reflects a high likelihood of malicious intent. The overall risk assessment is high due to the recent registration, brand impersonation, active blocking, and multiple vendor detections. Defenders should immediately add krakenmarketonion.com to DNS and URL filtering rules, monitor outbound connections to its IP address, and consider broader threat‑intel correlation for other domains registered by the same registrar or using the same nameserver pattern. Continuous monitoring of related indicators is recommended to detect any evolution of the campaign.