kraken6gf6o4rxewycqwjgfchzgxyfeoj5xafqbfm4vgvyaig2vmxyd[.]com

This domain, kraken6gf6o4rxewycqwgfchzgxyfeoj5xafqbfm4vgvyaig2vmxyd.com, is identified as a brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic legitimate Kraken infrastructure, likely to deceive users into disclosing sensitive credentials or transferring digital assets. No specific drainer kit signatures were confirmed, but the domain’s structure and timing align with known cryptocurrency phishing campaigns. The page title 'Just a moment...' suggests the use of Cloudflare or similar proxy services to obscure backend infrastructure, a common tactic in phishing operations to evade detection and takedown efforts. Infrastructure analysis reveals the domain was registered on March 29, 2026, through Gname 172 Inc, a registrar frequently associated with high-risk domains. It resolves to the IP address 45.130.151.196 and employs technologies such as Cloudflare Browser Insights, Cloudflare, and HTTP/3, alongside a Let’s Encrypt SSL certificate. The domain appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. Additional detection by PhishDestroy further corroborates its malicious classification. No presence on Google Safe Browsing (GSB) was noted at the time of analysis, though this may reflect delays in GSB updates rather than a clean status. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. However, the infrastructure remains a residual risk, as threat actors may reactivate it or repurpose the IP address for future campaigns. Users who interacted with the domain should assume credential compromise and initiate account recovery protocols, including password resets and multi-factor authentication reviews. Organizations are advised to monitor for related domains registered through Gname 172 Inc or resolving to 45.130.151.196, as these indicators may signal ongoing or evolving threats. Proactive blocking of the domain and IP at network and endpoint levels is recommended to mitigate potential exposure.