kraken36-at[.]com

PhishDestroy classifies kraken36-at.com as an elevated-risk brand impersonation domain targeting Kraken users. This domain was registered on August 12, 2024 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to 185.226.92.168. VirusTotal analysis shows 19 out of 95 security vendors flagging the domain, indicating partial but not universal detection. The presence of a Let's Encrypt SSL certificate suggests the operators are attempting to appear legitimate, while the recent registration date indicates opportunistic abuse of the Kraken brand. Risk assessment for kraken36-at.com is elevated due to the combination of active impersonation, low-to-moderate detection coverage, and freshly minted infrastructure. The domain’s age (just days old at time of discovery) suggests it is part of a fast-moving campaign likely aimed at harvesting credentials or payment data under the guise of the legitimate Kraken cryptocurrency exchange. The IP address 185.226.92.168 has no established reputation, increasing the likelihood of malicious hosting. The registrar’s permissive policies and the use of a free certificate provider further lower operational friction for threat actors, enabling rapid domain turnover and evasion of takedowns. Mitigation begins with blocking kraken36-at.com at DNS and network levels using exact domain matching. Users who may have visited should immediately change passwords and enable multi-factor authentication on legitimate Kraken accounts. Report suspicious activity to Kraken’s abuse channels and forward indicators to threat intelligence platforms. Organizations are advised to update browser and email filtering rules with this domain and the associated IP, while monitoring for similar domains registered through NICENIC with keywords like “kraken” or “exchange”. Continuous monitoring is critical given the domain’s recent creation and active threat status.