kraken-25att[.]com

The domain kraken-25att.com is identified as a brand_impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis confirms the domain is currently offline, though it previously functioned as part of a phishing infrastructure designed to deceive users into divulging credentials or financial information under false pretenses. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. It resolved to the IP address 185.226.92.168 and was flagged by 15 of 95 security vendors on VirusTotal, indicating a moderate-to-high detection rate. The domain appears on one security blocklist, further corroborating its malicious classification. No additional subdomains or associated certificates were identified in passive DNS records at the time of analysis. Current assessment indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential threat vector if reactivated. Organizations and individuals are advised to block the domain and associated IP address at the network perimeter. Users should verify the authenticity of communications claiming to originate from Kraken by cross-referencing with official channels. Security teams are recommended to monitor for resurgence or similar domains registered through the same registrar, particularly those mimicking cryptocurrency platforms.