kraken17-at-kraken[.]com

Analysis dated July 29, 2026 indicates that the domain kraken17-at-kraken.com was registered on May 27, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative nameservers are a.dnspod.com, b.dnspod.com, c.dnspod.com, which are typical of DNSPod services. DNS resolution returns a single IPv4 address 185.226.92.168. The host is currently listed as active. VirusTotal has recorded 15 of 91 security vendors flagging the domain as malicious, reflecting a moderate level of consensus among scanning engines.

The domain appears on one public blocklist and is specifically blocked by the PhishDestroy service, confirming its inclusion in at least one curated phishing mitigation feed. No public evidence has been provided regarding SSL certificates, HTTP response codes, page titles, or additional infrastructure such as ASN or hosting provider. Consequently, the precise nature of the hosted content cannot be confirmed, but the presence on multiple detection platforms and blocklists indicates a high likelihood of phishing use. Defenders should add 185.226.92.168 and kraken17-at-kraken.com to deny‑list rules in perimeter firewalls, DNS filtering, and secure web gateways. Continuous monitoring of the IP address for any new services or changes in DNS records is recommended.

Because the registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED, threat‑intel teams may consider contacting the registrar for takedown assistance. Organizations employing email or web security controls should ensure that the domain is included in their threat‑intelligence feeds to prevent credential‑ harvesting attempts. Uncertainties remain regarding the exact phishing payload, target brand, or compromised credentials, as no page‑title or content analysis is available. Ongoing investigation should focus on capturing HTTP traffic if the domain becomes active in user environments, and on correlating any observed credential submissions with known compromise patterns.