kraken-gold-rush[.]net

The domain kraken-gold-rush.net was registered on 16 October 2025 through Dynadot LLC and is currently resolving to the IP address 172.67.142.18, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 identifier, and it responds with HTTP 200 over HTTP/3, indicating an operational web service. Technical fingerprinting shows a WordPress stack backed by MySQL and PHP, with Cloudflare Browser Insights enabled and the authoritative nameservers matt.ns.cloudflare.com and olga.ns.cloudflare.com. Threat intelligence flags the domain as a high‑risk crypto‑scam that impersonates the legitimate exchange Kraken.

The page title “Kraken Gold Rush – Jogue Grátis ou Deposite e Ganhe” explicitly references the brand, supporting the classification as brand impersonation. VirusTotal analysis reports that 13 of 95 security vendors have flagged the domain, confirming malicious intent. Independent blocklist monitoring shows the domain is listed on a single security blocklist and has been added to the PhishDestroy blocklist, demonstrating that at least one anti‑phishing service has taken mitigation action. The Gridinsoft trust score of 0 out of 100 further reflects a lack of credibility.

While the available data confirms active hosting, a valid certificate, and multiple detections, no public samples of payloads or specific command‑and‑control infrastructure have been disclosed. Consequently, the precise malicious capabilities beyond the advertised crypto lure remain unverified. Defenders should block the domain at network perimeter devices, update DNS filtering policies to deny resolutions to 172.67.142.18, and monitor for any authentication attempts against Kraken‑related credentials originating from this host. Continuous re‑evaluation is advised, as the threat actor may expand infrastructure or modify the site content without notice.