kraken28[.]cc

This domain presents an elevated risk as a brand impersonation threat specifically targeting Kraken, a popular cryptocurrency exchange. The site was designed to deceive users into believing they were interacting with legitimate Kraken services, likely to harvest login credentials or private keys through a fake login page. PhishDestroy identified this threat through its unique seed 74b34b, and analysis confirms it was an active phishing campaign before being taken offline.

Technical indicators paint a clear picture of malicious intent. VirusTotal flagged the domain with 6 out of 95 security vendors marking it as malicious, and it appeared on one security blocklist. The domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with suspicious domains. It resolved to IP address 86.54.25.38 and lacked an SSL certificate, which is a major red flag for any site handling sensitive information. The page title was simply the domain name itself, a common tactic among phishing sites to appear generic. These details collectively confirm the domain was set up for fraudulent purposes.

To stay safe, users should always verify the official Kraken domain before logging in or entering any personal information. Kraken's legitimate website uses HTTPS and a valid SSL certificate, so the absence of one on kraken28.cc is a clear warning sign. Users who may have interacted with this domain should immediately change their Kraken passwords and enable two-factor authentication. PhishDestroy recommends reporting any similar domains to security teams and bookmarking the official Kraken URL for future access. Remaining vigilant against brand impersonation attempts is essential in the crypto space where such attacks are prevalent.