krakenhowto[.]cc

krakenhowto.cc was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026. The domain is being used to impersonate the cryptocurrency exchange Kraken, presenting a fake exchange interface aimed at harvesting credentials and funds. The threat is classified as brand impersonation with a high risk rating. Technical analysis shows the domain resolves to IP address 23.137.249.67, which is geolocated to the Netherlands and is owned by IncogNET LLC. DNS resolution uses the nameservers ns1.incoghost.com and ns2.incoghost.com. The site presents an HTTP 403 response and serves a Let’s Encrypt certificate (E8). VirusTotal reports 7 out of 95 scanners flagging the domain, and it appears on one public blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100. The limited detection surface—primarily the 403 status page—prevents direct observation of the phishing payload, leaving the exact landing page content uncertain. However, the presence of a legitimate‑looking SSL certificate, the use of compromised or rented infrastructure, and the low trust score all indicate a purposeful attempt to deceive Kraken users. The AlienVault OTX pulse linking the domain confirms that it has been observed in at least one prior campaign. Defenders should add krakenhowto.cc to URL filtering and DNS block lists, and also consider blocking the associated IP 23.137.249.67. Continuous monitoring of the nameservers ns1.incoghost.com and ns2.incoghost.com is advised, as they may be reused for additional malicious domains. User education campaigns should warn employees and customers about unsolicited Kraken login requests, especially those that direct to unfamiliar URLs or present unexpected SSL certificates. Incident response teams should be prepared to investigate any credential submissions that may have been captured by this infrastructure.