kra37at[.]com

The domain kra37at.com has been identified as a brand impersonation phishing site specifically targeting the cryptocurrency exchange Kraken. This threat is categorized as a crypto drainer, designed to steal login credentials and potentially drain digital assets from unsuspecting users. As of the latest assessment, the domain is offline, but it poses a significant risk to anyone who may have interacted with it while active.

PhishDestroy's analysis reveals that kra37at.com was created on March 27, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IP address 104.21.44.76 and uses an SSL certificate issued by Google Trust Services (WE1). Notably, 6 out of 95 security vendors on VirusTotal flagged this domain as malicious, indicating a moderate consensus on its dangerous nature. It also appears on one security blocklist. The page title was observed as "kra37.at – Актуальный вход," which roughly translates to "Actual Login" in Russian, further supporting its intent to deceive users into entering their Kraken credentials.

Given that kra37at.com is now offline, the immediate risk of direct interaction is reduced. However, users should remain vigilant and verify any communications or links purporting to be from Kraken. PhishDestroy recommends that anyone who may have visited this domain or provided any information should change their Kraken account passwords immediately, enable two-factor authentication, and monitor their accounts for unauthorized activity. Always double-check URLs and avoid logging in through unsolicited links.