kra39at[.]cc

This domain, kra39at.cc, is flagged as a high-risk brand impersonation site specifically targeting Kraken, a major cryptocurrency exchange platform. Analysis indicates the site employs a phishing framework designed to harvest user credentials and cryptocurrency wallet information, likely through a wallet-draining kit. The page title, KRAKEN, directly mimics the legitimate platform, increasing the likelihood of successful deception among users attempting to access their accounts or perform transactions. Infrastructure analysis reveals the domain was registered on January 19, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.96.3, hosted on CloudFlare infrastructure in Canada. The domain is flagged by 11 out of 95 security vendors on VirusTotal, and appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services (WE1), which may lend an appearance of legitimacy to unsuspecting users. The domain has been actively blocked by multiple security frameworks, including PhishDestroy, MetaMask, and SEAL. As of the latest assessment, kra39at.cc has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat due to the domain's recent creation and association with known phishing campaigns. Users who accessed the site prior to its takedown should assume credential compromise and take immediate action, including password resets, wallet key rotation, and transaction monitoring. Organizations are advised to maintain blocklist updates and monitor for similar domains registered through the same registrar or resolving to the identified IP range.