webs[.]cloudproduction-netflix[.]m-kraken[.]net

The domain webs.cloudproduction-netflix.m-kraken.net has been identified as a high-risk phishing resource specializing in brand impersonation, specifically targeting Kraken, a cryptocurrency exchange platform. Analysis confirms the domain is currently offline, though prior activity indicates malicious intent to deceive users into disclosing sensitive credentials or interacting with fraudulent interfaces. The page title, 'Web Hosting by InMotion Hosting,' does not align with the purported Kraken branding, further suggesting deceptive infrastructure. Infrastructure analysis reveals the domain was registered through Squarespace Domains LLC on February 21, 2026, an unusually future-dated creation that may indicate evasion tactics. It resolves to the IP address 213.165.251.179, located in the Netherlands under AS22611 (InMotion Hosting, Inc.). Detection metrics indicate 22 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on three distinct security blocklists. Notably, the domain lacks SSL certification, a common red flag for fraudulent sites. Additional intelligence sources confirm blocking by multiple threat intelligence platforms, reinforcing its classification as a high-risk resource. At present, the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to verify all cryptocurrency-related communications through official channels and avoid domains with irregular registration details or mismatched branding. Network administrators should update blocklists to include this domain and its associated IP address, while end-users should monitor for unauthorized account activity. Future vigilance is recommended, as threat actors frequently repurpose infrastructure for subsequent campaigns.