# kraken23at.net — SUSPICIOUS

> kraken23at.net identified as Kraken brand impersonation crypto drainer. VT 1/95 flags this impostor domain. Avoid interacting with this site immediately.

## Summary
PhishDestroy identifies kraken23at.net as an active brand impersonation domain targeting Kraken cryptocurrency exchange users. The domain masquerades as the legitimate Kraken platform, likely deployed to harvest credentials or facilitate crypto-draining operations through fraudulent deposit addresses. While no drainer kit fingerprint was detected in available telemetry, the page’s social engineering tactics align with known crypto-scam infrastructure designed to trick victims into transferring assets to attacker-controlled wallets.  This domain was flagged by VirusTotal with a detection ratio of 1 out of 95 security vendors as of latest scan. It resolves to IP 188.114.96.3, is registered through Virtualia LLC, and went live on August 22, 2025. Despite hosting under a Google Trust Services SSL certificate, the page does not appear on Google Safe Browsing lists and remains currently unlisted on major blocklists, increasing exposure risk to unsuspecting users.  Current status is active and elevated. Immediate defensive actions include adding both the domain and its IP to corporate blocklists, flagging the registrar for abuse escalation, and raising user awareness. Remaining risk persists due to the domain’s recent creation, low detection rate, and credible SSL issuance, indicating opportunistic deployment. Organizations should inspect internal DNS logs for recent resolutions to 188.114.96.3 and scan endpoints for outbound connections to kraken23at.net as part of post-exposure triage.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Kraken

## Domain Intelligence
- Registered: 2025-08-22 18:34:46
- Registrar: Virtualia LLC
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/1f2cdc58-3b78-4611-a8fd-cc552f65f11c
- PhishDestroy: https://phishdestroy.io/domain/kraken23at.net/
- LLM endpoint: https://phishdestroy.io/domain/kraken23at.net/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/kraken23at.net/
Last updated: 2026-03-27