kra-kenss[.]top

This domain, kra-kenss.top, poses a high-risk brand impersonation threat targeting users of the Kraken cryptocurrency exchange. Analysis indicates the site mimics legitimate Kraken branding, including the use of a deceptive page title 'KraKen,' to trick users into entering sensitive credentials or transferring digital assets. The domain is designed to harvest login details, seed phrases, or initiate unauthorized transactions, likely deploying a crypto drainer script upon interaction. Given the prevalence of such attacks in the cryptocurrency sector, this infrastructure represents a significant risk to unsuspecting users seeking to access Kraken services. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 06, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.62.47, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of phishing infrastructure. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly labels it as phishing. Additionally, the domain appears on one security blocklist and lacks an SSL certificate, further undermining its legitimacy. The combination of these factors—recent registration, absence of encryption, and multi-source detections—strongly suggests a coordinated phishing campaign. Users who have visited kra-kenss.top or interacted with its content should take immediate action to mitigate potential compromise. First, revoke any active sessions or connected wallets associated with the site via the legitimate Kraken platform. Second, monitor all linked accounts for unauthorized transactions and enable multi-factor authentication if not already active. Third, scan local devices for malware using updated security tools, as phishing sites may deploy secondary payloads. If credentials were entered, reset passwords for Kraken and any other platforms where identical login details were reused. Finally, report the domain to relevant authorities or security teams to aid in broader threat disruption efforts.