kraken6[.]net

Analysis indicates that kraken6.net is an active brand-impersonation domain targeting the Kraken cryptocurrency exchange. The domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 104.21.80.237, hosted on Cloudflare infrastructure in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (shaz.ns.cloudflare.com and yadiel.ns.cloudflare.com), along with Cloudflare Browser Insights and HTTP/3 support, which are common among phishing sites leveraging Cloudflare's services to obscure origin servers and evade detection. The domain presents a page title of 'KRAKEN,' directly matching the targeted brand, and is flagged by at least one security blocklist (PhishDestroy). A 301 HTTP redirect is currently in place, which may indicate an attempt to funnel victims to another malicious endpoint or to evade automated crawlers. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain's malicious intent but may lend a false sense of legitimacy to potential victims. As of July 12, 2026, the domain remains active and has been detected by 3 of 94 security vendors on VirusTotal, confirming its classification as a high-risk threat. The Gridinsoft trust score of 0/100 further supports this assessment. Defenders should treat this domain as malicious and prioritize blocking or monitoring traffic to it. Given the use of Cloudflare and the presence of a redirect, additional investigation into connected infrastructure (e.g., redirect targets, associated IPs, or domains) is recommended to identify related threats. The exact content and functionality of the site are not yet analyzed, but the domain's infrastructure and known indicators align with typical brand-impersonation phishing campaigns targeting cryptocurrency users.