krakengift[.]com

This domain, krakengift.com, is identified as a high-risk brand impersonation threat specifically targeting users of the Kraken cryptocurrency exchange. Analysis indicates the site presents itself as an official Kraken platform, offering purported gifts or reactions under the page title 'Подарки и реакции на Кракен.' Such impersonation tactics are commonly employed to lure victims into disclosing sensitive credentials, transferring funds, or installing malicious software under false pretenses. The domain’s infrastructure and content are designed to exploit trust in the Kraken brand, increasing the likelihood of successful social engineering attacks. Evidence supporting this assessment includes multiple technical indicators. The domain is flagged by 13 out of 95 security vendors on VirusTotal, with detections categorized under social engineering. It appears on four independent security blocklists, further corroborating its malicious nature. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The site resolves to the IP address 188.114.97.3 and employs technologies such as Yandex.Metrika and Cloudflare, which are often leveraged to obscure tracking or evade detection. Additionally, the domain is blocked by multiple security frameworks, including MetaMask and SEAL, reinforcing its classification as a threat. Users who have visited krakengift.com should take immediate action to mitigate potential risks. If any credentials, wallet addresses, or personal information were entered on the site, these should be considered compromised and changed immediately across all platforms. Affected users are advised to monitor their accounts for unauthorized transactions and enable multi-factor authentication where available. Devices used to access the domain should undergo a thorough security scan to detect and remove any malware or unwanted software. Given the domain’s offline status, users should remain vigilant for similar impersonation attempts, as threat actors may deploy new domains or tactics to continue their campaigns.