kraken-wallet[.]net

Analysis shows that kraken-wallet.net was registered on February 21, 2026 through the registrar Spaceship, Inc. The domain carries a Gridinsoft trust score of 0 out of 100, indicating an extreme lack of credibility. It is classified as a cryptocurrency‑focused impersonation campaign targeting the Kraken brand, and its current status remains active.

Infrastructure investigation reveals that the domain resolves to the IPv6 address 2400:cb00:2048:1::681b:bf59, which maps to a location in the United States. Authoritative name servers bob.ns.cloudflare.com and gemma.ns.cloudflare.com point to a content delivery network that provides Cloudflare Browser Insights and HTTP/3 support. The TLS certificate presented is issued by Google Trust Services under the WE1 authority, showing a valid HTTPS handshake despite the malicious intent.

The web server returns HTTP 200 and presents a generic page titled "Default Web Site Page," offering no legitimate Kraken branding or functionality. VirusTotal records five out of ninety‑five security vendors flagging the domain as malicious, and the site appears on three external blocklists, including entries from PhishDestroy, MetaMask, and SEAL. These detections corroborate the domain’s association with phishing and cryptocurrency fraud.

Given the high‑risk classification, defenders should add kraken-wallet.net to network‑level deny lists and monitor DNS queries for any resolution attempts. Email gateways and web proxies ought to block outbound connections to the identified IPv6 address and associated name servers. Incident response teams should also inspect user traffic logs for interactions with the default page, as the site may later host credential‑harvesting forms or malicious payloads. Continuous re‑evaluation is advised, as the adversary could modify the content while retaining the same infrastructure.