krakenkrab1[.]net

The domain krakenkrab1.net was registered on December 19, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently listed as taken offline. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are ns1.suspended-domain.com and ns2.suspended-domain.com, both of which are commonly associated with abandoned or suspended domains. The SSL certificate presented is identified as WE1, indicating a self‑issued or low‑trust certificate without reputable validation.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing the notion that it is being used for malicious activity. VirusTotal reports that 15 of 95 scanning engines flag the domain, providing moderate consensus of malicious behavior. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, suggesting the site is highly untrustworthy. The domain is categorized as a crypto‑related scam and specifically impersonates the Kraken brand, a well‑known cryptocurrency exchange.

While the site is offline, the combination of a recent registration date, low‑reputation hosting, suspicious nameservers, a weak SSL certificate, multiple vendor detections, and explicit blocklist entries creates a strong indicator of a brand‑impersonation campaign targeting Kraken users. Uncertainty remains around the exact content that was served before the takedown, as no page title or HTTP response is available for analysis. Defenders should block the domain at network perimeter, add it to internal threat‑intel feeds, monitor for any future re‑registration, and advise users to verify any communications purportedly from Kraken against official channels. Continuous monitoring of the associated IP address and related Cloudflare‑hosted assets is recommended to detect possible re‑use in other campaigns.