2km[.]to

This domain is flagged for elevated-risk brand impersonation, specifically targeting the Kraken cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into submitting credentials or wallet access details through a fraudulent interface mimicking legitimate Kraken services, as evidenced by the page title 'KRAKEN' and domain registration patterns. Infrastructure analysis reveals the following technical indicators: the domain 2km.to is registered through the Government of Kingdom of Tonga and was created on October 29, 2025. It resolves to IP address 104.21.75.25, hosted on Cloudflare's network (AS13335, US). Security vendor detections on VirusTotal show 13 out of 95 engines flagging the domain, while it appears on one security blocklist. The domain's SSL certificate is issued by Google Trust Services (WE1). The domain is currently offline, though prior activity suggests it was actively used for malicious purposes. Mitigation against this brand impersonation threat requires immediate action from both users and network defenders. Organizations should block the domain 2km.to and its associated IP 104.21.75.25 at perimeter security controls. Users who may have interacted with this domain should reset credentials on legitimate Kraken accounts, enable multi-factor authentication, and verify wallet addresses before transactions. Security teams should monitor for similar domain registrations using the .to TLD or Cloudflare-hosted infrastructure mimicking financial services brands. Given the domain's recent creation date, continuous monitoring of newly registered domains with similar characteristics is recommended.