kraken31-at-kra[.]com

This domain, kraken31-at-kra.com, is flagged for brand impersonation targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they are interacting with legitimate Kraken services, likely to harvest credentials, financial details, or distribute malware under the guise of the trusted brand. The infrastructure and naming convention (kraken31-at-kra) suggest an intent to exploit user trust in the Kraken brand while evading basic detection mechanisms. Infrastructure analysis reveals the domain resolves to the IP address 185.226.92.168, hosted in Turkey under the provider BIGCORE. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Security validation shows 16 out of 95 engines on VirusTotal flagged the domain as malicious, while it appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt (R12), is consistent with phishing campaigns that leverage free certificates to appear legitimate. Users who visited kraken31-at-kra.com should immediately revoke any credentials entered on the site, particularly cryptocurrency wallet or exchange login details. Monitor financial accounts for unauthorized transactions and consider resetting passwords for any services where the same credentials may have been reused. If malware was downloaded, isolate the affected device and conduct a full system scan using updated security tools. Report the incident to relevant fraud teams, including the targeted brand’s security contact, to aid in takedown efforts and further analysis.