kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7n[.]com

The domain kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7n.com was used in a brand impersonation phishing campaign targeting Kraken users. The site displayed a page titled "KRAKEN" to trick visitors into believing they were on the legitimate Kraken platform, likely aiming to steal login credentials, personal information, or cryptocurrency funds. This type of threat exploits trust in well-known brands to harvest sensitive data from unsuspecting users.

Evidence from security scans shows that 6 out of 95 security vendors on VirusTotal flagged this domain as malicious, indicating a notable but not universal detection rate. The domain was registered through NiceNIC International Group Co., Limited on February 23, 2026, and its SSL certificate was issued by Let's Encrypt (fingerprint E8), which added a false sense of security. The domain currently resolves to IP address 172.67.221.187 and has been added to three security blocklists. Fortunately, the domain has now been taken offline, but it may reappear under a similar name.

Any user who visited this domain while it was active should immediately change their Kraken account password and enable two-factor authentication if not already done. They should also monitor their Kraken account for unauthorized transactions and consider running a security scan on their device for any malware that may have been downloaded. PhishDestroy recommends always verifying URLs by typing them directly into the browser rather than clicking links in emails or messages. If users suspect their credentials were compromised, they should contact Kraken support and report the incident to relevant authorities.