kra21s[.]cc

The domain kra21s.cc has been assessed at an elevated risk level due to its identification as a generic phishing domain specifically targeting cryptocurrency exchange users. This threat is characterized as a credential theft campaign, designed to trick victims into surrendering their login details under the guise of a legitimate service. The domain was taken offline, but its prior activity warrants scrutiny.

VirusTotal data reveals that 12 out of 95 security vendors flagged the domain as malicious, and it appears on one security blocklist. The domain was registered through Gname 218 Inc and resolves to the IP address 86.54.24.57, created on March 29, 2026. An SSL certificate from Let's Encrypt (type E8) was observed, adding a layer of false legitimacy. AlienVault OTX records show the domain appeared in one threat intelligence pulse, indicating its use in a coordinated attack.

Users who may have encountered kra21s.cc should immediately change their Kraken account passwords and enable two-factor authentication (2FA) if not already active. It is also advisable to monitor account statements for unauthorized transactions and report any suspicious activity to Kraken support. Moving forward, always verify the URL before entering credentials and avoid clicking on links from unsolicited communications.