kra28-at[.]com

This domain, kra28-at.com, is identified as a brand impersonation threat targeting the Kraken cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing it was an official Kraken portal, potentially facilitating credential harvesting or fraudulent transactions. No specific crypto drainer kit signatures were detected in initial scans, but the domain exhibits characteristics consistent with phishing infrastructure used in financial fraud schemes. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.89.62, hosted behind Cloudflare services (including Cloudflare Browser Insights and HTTP/3). It was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is assigned a trust score of 0/100, indicating no legitimacy. Google Safe Browsing status is not explicitly listed, but the single blocklist presence suggests limited but targeted detection. As of the latest assessment, kra28-at.com has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed. Users who accessed the site prior to takedown may still be at risk of credential compromise or follow-up social engineering attacks. Organizations are advised to monitor network logs for connections to 104.21.89.62 and kra28-at.com, and to implement blocklist updates to prevent future access attempts. Given the elevated risk classification, affected users should rotate credentials for any accounts accessed via this domain and enable multi-factor authentication on all financial platforms.