kraken--17att[.]net

The domain kraken--17att.net has been identified as a brand impersonation threat specifically targeting the Kraken cryptocurrency exchange. This domain is currently offline, but during its active period it presented a page titled 'Kraken17 at – Постоянный доступ без ограничений' which translates to 'Constant access without restrictions,' likely luring users with the promise of uninterrupted service. The domain was created on March 27, 2026, and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting malicious domains. It resolved to IP address 172.67.216.205 and held an SSL certificate from Google Trust Services, adding a false sense of legitimacy.

Security analysis reveals that this domain was flagged by 12 out of 95 VirusTotal vendors, indicating strong consensus on its malicious nature. It also appeared on one security blocklist and was found in one AlienVault OTX threat intelligence pulse. Despite being taken offline, the domain's infrastructure and registration details remain indicators for future threats. The use of a brand impersonation tactic combined with the promise of unrestricted access suggests this was designed as a crypto drainer or credential theft site, aiming to harvest login credentials or seed phrases from Kraken users.

Given that the domain is now offline, the immediate risk is reduced, but users should remain vigilant. PhishDestroy recommends that all Kraken users ensure they are accessing the official website directly, enable two-factor authentication, and avoid clicking on links from unsolicited messages. Security teams should block the domain kraken--17att.net and its associated IP address 172.67.216.205 at the network level to prevent any residual access. Continuous monitoring for similar domains using the same registration patterns is advised.