kraken5[.]us

This domain, kraken5.us, is confirmed as a brand impersonation phishing site targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing they were accessing legitimate Kraken services, likely for credential harvesting or fraudulent transactions. The domain is currently offline, but prior activity aligns with phishing campaigns observed in the cryptocurrency sector. Infrastructure analysis reveals the domain was registered on June 13, 2025, through GrepApps Technology Inc. and resolved to the IP address 104.21.60.249. It was flagged by 6 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The site was hosted behind Cloudflare and appeared on one security blocklist. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy to phishing infrastructure. The page title, '404 Not Found,' suggests the site may have been taken down or altered post-compromise to evade detection. While kraken5.us is currently offline, the domain remains a potential threat vector. Organizations and users are advised to block the domain and its associated IP address (104.21.60.249) at the network level. Security teams should monitor for related domains registered through the same registrar (GrepApps Technology Inc.) or resolving to the same IP range. Users who may have interacted with the site should reset credentials for Kraken and any other services where identical passwords were reused. Cryptocurrency holders are urged to verify transaction histories for unauthorized activity.