autodiscover[.]kraken[.]net[.]bo

Analysis indicates that the domain autodiscover.kraken.net.bo was registered on 21 February 2026 and resolves to the IPv4 address 190.129.114.119, which is announced by ASN 6568 belonging to EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA in Bolivia. The web server presents Nginx and enforces HTTP Strict Transport Security, and the TLS certificate is issued by Let’s Encrypt (R13). An HTTP GET returns status code 200 and the page title is “mail.kraken.net.bo - mail UI”, explicitly referencing the Kraken brand. The observed content aligns with a crypto‑scam classification and the domain is listed as impersonating Kraken.

Reputation scoring from Gridinsoft is 0 out of 100, indicating minimal trust. VirusTotal records show that two of ninety‑three scanning engines have flagged the domain, and the host appears on three external blocklists, including PhishDestroy, MetaMask and SEAL. The site is currently marked as active. While the available data confirms the infrastructure and brand‑impersonation intent, the internal mechanics of the scam page (e.g., credential capture forms) have not been publicly disclosed, leaving the exact threat vector uncertain.

Defenders should block outbound connections to 190.129.114.119 at the network perimeter, enforce domain‑level deny lists that include autodiscover.kraken.net.bo, and monitor for any authentication attempts to Kraken‑related services originating from internal users. Email gateways should be configured to flag messages containing URLs that resolve to this domain, and security awareness training should remind users that legitimate Kraken communications never originate from subdomains under *.net.bo. Continuous re‑evaluation is advised, as additional detection vendors may update their verdicts and further blocklist entries could appear.