kraken12[.]cc

The domain kraken12.cc is a confirmed phishing site engaged in brand impersonation targeting Kraken, a well-known cryptocurrency exchange. It operates as a fake exchange scam, designed to deceive users into believing they are interacting with the legitimate Kraken platform. As of the latest verification, kraken12.cc has been taken offline, though it previously posed an elevated risk of credential theft or financial fraud.

Technical analysis of kraken12.cc reveals limited detection by security vendors, with 2 of 95 VirusTotal vendors flagging it, including alphaMountain.ai and Forcepoint ThreatSeeker. The domain appears on 1 security blocklist, specifically PhishDestroy. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026, and uses Cloudflare nameservers (mcgrory.ns.cloudflare.com and naomi.ns.cloudflare.com). No IP address or SSL issuer information is available, and the observed HTTP status was 403. Google Safe Browsing has not flagged the domain.

Users who may have interacted with kraken12.cc should immediately change their Kraken account passwords and enable two-factor authentication (2FA) if they entered credentials. Monitor account activity for unauthorized transactions and report any suspicious behavior to Kraken support. Additionally, victims can report the phishing domain to their local cybercrime unit or platforms like the Anti-Phishing Working Group (APWG) to aid in takedown efforts.