kraken-fees-calculator[.]github[.]io

This domain, kraken-fees-calculator.github.io, operates as a high-risk brand impersonation threat targeting Kraken cryptocurrency exchange users. The site presents itself as a legitimate fee calculator tool, likely designed to harvest login credentials, API keys, or other sensitive financial information from unsuspecting victims. Analysis indicates the page title explicitly mimics official Kraken branding, increasing the likelihood of successful social engineering attacks against users seeking fee estimation services. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain is flagged by 7 out of 95 security vendors on VirusTotal, with registration handled through MarkMonitor, Inc. Despite the future creation date listed (February 21, 2026), the domain currently resolves to 185.199.110.153, a US-based IP under AS54113 (Fastly, Inc.). The site employs a Let's Encrypt SSL certificate (R12) to appear legitimate, while appearing on one security blocklist and being actively blocked by enterprise security systems. The combination of brand impersonation tactics and technical obfuscation through reputable hosting infrastructure demonstrates sophisticated threat actor methodology. Users who have visited kraken-fees-calculator.github.io should immediately revoke any entered credentials and monitor their Kraken accounts for unauthorized activity. All cryptocurrency-related credentials should be rotated, with particular attention to API keys that may have been exposed. The domain's continued activity status (confirmed as of this report) necessitates adding 185.199.110.153 to network blocklists and implementing DNS-level filtering for the full domain. Organizations should examine proxy logs for connections to this IP and domain, while affected individuals should enable multi-factor authentication on all financial accounts as an additional security measure.