kraken24[.]vip

PhishDestroy identifies kraken24.vip as an active brand impersonation domain targeting Kraken cryptocurrency exchange. The elevated risk stems from deliberate visual and textual mimicry of Kraken’s official branding to deceive users into entering credentials or transferring funds. The domain resolves to IP 104.21.10.123 and relies on a Google Trust Services SSL certificate to appear legitimate. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on December 14, 2020, this site has been minimally flagged by security vendors—only 1 out of 95 detection engines on VirusTotal currently identifies it as malicious.

This domain was flagged specifically for its use of brand impersonation, a tactic frequently deployed in credential theft and crypto drainer campaigns. The low VT detection rate may indicate evasion tactics such as rapid domain rotation or cloaking based on user profile. Additionally, the domain’s association with a known registrar and its SSL certificate from a recognizable CA could mislead users into believing it is trustworthy. The lack of widespread blocklisting suggests this threat is either emergent or highly targeted.

To mitigate exposure to kraken24.vip, users and organizations should immediately block the domain at the network and endpoint levels. DNS filtering solutions should include kraken24.vip and its resolving IP (104.21.10.123) in blocklists. End users should verify website URLs manually and avoid clicking links from unsolicited emails or social messages. Organizations should update employee security awareness training to recognize brand impersonation tactics and report suspicious domains to IT or security teams. Security teams are advised to monitor for new domains registered under similar naming patterns and to inspect SSL certificates for anomalies.