xn--krken25-bn4c[.]com

This domain is flagged for elevated risk due to brand impersonation targeting Kraken, a cryptocurrency exchange platform. The threat involves mimicking legitimate branding to deceive users into disclosing sensitive information or interacting with malicious content, potentially leading to financial or credential compromise. Analysis indicates the domain was specifically designed to exploit trust in the Kraken brand, as evidenced by its misleading page title and infrastructure setup. Infrastructure analysis reveals the domain xn--krken25-bn4c.com was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to IP address 101.99.76.111 and employs an SSL certificate issued by Let's Encrypt. The domain appears on one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal. Detected technologies include Node.js, Ubuntu, Nginx, and Express, suggesting a modern web stack potentially used to host deceptive content. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. Mitigation steps for brand impersonation threats include immediate domain takedown requests to registrars and hosting providers, as well as blacklisting the domain and associated IP across security tools. Organizations should monitor for similar homograph domains (e.g., Punycode variations) and implement DNS filtering to block resolutions. Users should be educated to verify domain authenticity, particularly for cryptocurrency-related interactions, and to inspect SSL certificates for inconsistencies. Security teams are advised to correlate this domain with other indicators of compromise, such as the IP 101.99.76.111, to identify potential lateral movement or additional attack vectors.