# kraken21at.net — SUSPICIOUS

> PhishDestroy identifies kraken21at.net as a Kraken brand impersonation phishing site. 3/95 security vendors flag it. Check the full report.

## Summary
PhishDestroy identifies kraken21at.net as a live brand impersonation scam targeting the cryptocurrency exchange Kraken. This malicious domain (kraken21at.net) mimics the legitimate kraken.com to deceive users into entering account credentials or payment data by presenting a near-identical interface. The threat is elevated due to active hosting and a TLS certificate that triggers browser trust indicators, making it harder for victims to distinguish from the genuine site at first glance.


This domain poses concrete risks: it resolves to 104.21.85.223 and was registered by NICENIC INTERNATIONAL GROUP CO., LIMITED on June 07, 2024. PhishDestroy data shows 3 out of 95 VirusTotal security vendors already flag it for malicious activity, indicating early detection by the security community. The presence of a Google Trust Services SSL certificate further legitimizes the scam, suggesting the operators invested in basic infrastructure to bypass automated warnings.


If you visited kraken21at.net or entered any information, assume compromise: change all passwords used on this site, revoke any API keys exposed, and monitor linked email addresses and wallets for unauthorized access or transactions. Report the domain to your antivirus vendor and Kraken’s abuse team. Use a password manager that flags lookalike domains, and always verify URLs via Kraken’s official channels before entering sensitive data. Stay vigilant—this campaign is likely to expand with more variants.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Kraken

## Domain Intelligence
- Registered: 2024-06-07 11:53:34
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.85.223

## Detection Status
- VirusTotal: 3 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/d7cc5b65-02fc-456c-827f-de6c7b7aca39
- PhishDestroy: https://phishdestroy.io/domain/kraken21at.net/
- LLM endpoint: https://phishdestroy.io/domain/kraken21at.net/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/kraken21at.net/
Last updated: 2026-03-27