kraken3yvbvzmhytnrnuhsy772i6dfobofu652e27f5hx6y5cpj7rgyd[.]top

The domain kraken3yvbvzmhytnrnuhsy772i6dfobofu652e27f5hx6y5cpj7rgyd.top is a brand impersonation threat specifically targeting the cryptocurrency exchange Kraken. Currently offline, this domain was designed to deceive users into entering sensitive credentials via a fake Captcha page. It was flagged by 16 out of 95 security vendors on VirusTotal, indicating a high level of malicious consensus. The domain was registered through the registrar 耐思尼克国际集团有限公司 on April 18, 2026, and resolves to IP address 104.21.72.4. It appears on one security blocklist and has an SSL certificate issued by Google Trust Services (WE1). AlienVault OTX includes this domain in one threat intelligence pulse, confirming its association with malicious activity.

As a phishing site, this domain likely functions as a crypto drainer or credential harvester, mimicking Kraken's login interface to steal account access. The use of a Captcha title page is a common tactic to phish two-factor authentication codes or bypass automated scanners. The domain's registration details suggest it was created specifically for this campaign, with a short lifespan before being taken offline. The elevated risk level reflects the direct targeting of a major crypto brand and the potential for financial loss if users were to interact with the site.

Given that the domain is now offline, the immediate threat is mitigated, but users who may have visited it should change their Kraken passwords and enable two-factor authentication immediately. It is crucial to verify any communication or login page through official channels and to use PhishDestroy to check for similar threats. Always double-check URLs before entering credentials, and avoid clicking on unsolicited links claiming to be from Kraken. Stay vigilant against brand impersonation attacks, as they are a persistent vector for crypto theft.