kraken12m[.]at

kraken12m.at was registered on March 28 2026 and actively served HTTP responses that returned a 403 status code before being taken offline. The domain is explicitly linked to a fake Kraken exchange operation, as indicated by the intelligence tag “Impersonates: Kraken” and the scam classification “Fake Exchange”. PhishDestroy has already added the site to its blocklist and the domain currently appears on one public security blocklist. A VirusTotal scan involving 94 anti‑malware engines returned no detections, which does not imply the domain is benign but reflects the current lack of payload signatures.

No public Safe Browsing, OTX, or registrar records were supplied, and no IP address, hosting provider, SSL certificate, or page title information is available for further correlation. The limited observable footprint consists of the creation date, HTTP 403 response, blocklist inclusion, and the vendor‑level scan result. Because the site is offline, immediate threat execution is halted, yet the registration pattern suggests a possible template for future impersonation campaigns targeting cryptocurrency exchange users.

Defensive teams should pre‑emptively block kraken12m.at at network perimeters, add it to email and web filtering rules, and monitor for new domains that share the “kraken” keyword or similar registration timestamps. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators, and any observed attempts to resolve the domain should be logged for incident response. Until further infrastructure details emerge, the domain remains a high‑confidence impersonation indicator requiring active mitigation.