kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7nj7instad[.]com

PhishDestroy identifies an active, elevated-risk brand impersonation threat tied to the domain kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7nj7instad.com. This domain closely mimics the legitimate Kraken cryptocurrency exchange, likely leveraging typosquatting to deceive users into entering credentials or downloading malware. The attacker’s infrastructure includes a domain registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on August 3, 2023, and hosted at IP 172.67.160.121. Notably, VirusTotal reports that 5 out of 95 security vendors have flagged this domain, underscoring its malicious nature while highlighting gaps in broad detection coverage. Analysts confirm this domain was engineered to exploit brand trust, deploying a valid SSL certificate issued by Google Trust Services to enhance credibility. The registration date and resolver IP align with a recent campaign, suggesting opportunistic deployment. While the domain remains active, the low but consistent detection rate (5/95) indicates selective visibility among security tools. This combination of typosquatting, valid TLS, and recent creation elevates the risk profile, making it particularly hazardous for users expecting legitimate Kraken services. If you have visited kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7nj7instad.com, immediately cease interaction, audit stored credentials, and enable multi-factor authentication on all Kraken accounts. Use endpoint detection tools to scan for unauthorized processes or data exfiltration. Report the domain to your security team and consider blocking 172.67.160.121 at the network perimeter. Monitor for anomalous login attempts or API calls from unfamiliar IP ranges. Proactively warn users about this campaign and reinforce verification of domain spelling and SSL validity before entering sensitive data.