kraken-fun[.]com

Analysis of kraken-fun.com, observed as offline as of the report date 24 July 2026, shows infrastructure consistent with a brand‑impersonation campaign targeting Kraken users. The domain was registered on 21 February 2026 through Cloudflare, Inc. and is served by the Cloudflare nameservers jerry.ns.cloudflare.com and sara.ns.cloudflare.com. DNS resolution points to IP 136.243.170.202, which belongs to Hetzner Online GmbH (ASN 24940) located in Germany. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier “E8”), confirming the use of a freely‑issued SSL certificate.

The page title returned by the server was “Pterodactyl”, a detail that does not directly reference the impersonated brand and suggests a generic landing page. VirusTotal scans recorded four detections out of ninety‑three security vendors, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing the malicious classification. The campaign is labeled as a crypto‑scam, with the brand target explicitly identified as Kraken, indicating that phishing or credential‑harvesting pages may have been hosted before takedown. While the site is currently offline, the hosting provider, IP address, and certificate remain active, allowing potential re‑deployment of the same infrastructure.

Defenders should block the domain and associated IP at perimeter defenses, monitor for re‑appearance of the host, and apply threat‑intelligence feeds that include the listed blocklists. Additionally, organizations using Kraken services should alert users to verify URLs carefully and consider deploying domain‑based authentication mechanisms such as DMARC, DKIM, and SPF for corporate‑issued emails that reference Kraken. Ongoing vigilance is advised, as the underlying hosting environment is still operational and could be reused for future impersonation attempts.