kraken38cc[.]live

This domain is flagged as a brand impersonation threat with an elevated risk level, specifically targeting users of the Kraken cryptocurrency exchange platform. The infrastructure is designed to deceive victims into believing they are interacting with legitimate Kraken services, likely through credential harvesting or fraudulent transaction requests. Analysis indicates the domain employs deceptive tactics, such as a 'Captcha' page title, to mimic legitimate security checks while capturing sensitive user data. Infrastructure analysis reveals the domain kraken38cc.live was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.58.16 and utilizes Cloudflare with HTTP/3 for content delivery, alongside a Google Trust Services SSL certificate. The domain appears on two security blocklists and is actively blocked by multiple threat intelligence feeds. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, confirming its association with phishing activity. Mitigation against this specific threat type involves immediate domain blocking at the network and endpoint levels. Organizations should update security policies to include the domain and its resolving IP (104.21.58.16) in deny lists. Users should be educated on recognizing brand impersonation tactics, particularly those involving cryptocurrency platforms, and encouraged to verify domain authenticity through official channels. Additionally, monitoring for similar domains registered through NiceNIC International Group Co., Limited or resolving to the same IP range may help preemptively identify related threats.