kyraken[.]com

Analysis of kyraken.com indicates this domain was actively impersonating the Kraken cryptocurrency exchange as recently as July 24, 2026. The domain was registered on February 21, 2026, and resolved to the IP address 31.97.103.72, hosted on infrastructure associated with Hostinger in the United States. Nameservers were set to ns1.dns-suspended.com and ns2.dns-suspended.com, a pattern often observed in domains flagged for abuse or suspended due to policy violations. At the time of assessment, the domain was offline, though it had previously displayed a page titled 'kyraken.com,' reinforcing its association with the targeted brand.

Eight of 93 security vendors on VirusTotal flagged kyraken.com as malicious, and the domain appeared on at least one security blocklist, including detection by PhishDestroy. While the exact content of the site was not analysed, the available metadata—including the domain name, page title, and stated brand target—strongly suggests an intent to deceive users by mimicking Kraken’s legitimate services. The use of a visually similar domain name (substituting a 'y' for an 'e') is a common tactic in brand impersonation schemes to exploit typographical errors or user inattention. Defenders should treat this domain as confirmed malicious infrastructure.

Network-level blocks at the IP and domain level are recommended, along with monitoring for any re-emergence of the domain or similar variations. Given the domain’s current offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential incident response or legal proceedings. No evidence currently links this domain to broader campaign infrastructure, though correlation with other Kraken-themed phishing domains may reveal additional threats.