kraken3yvbvzmhytnrnuhsy772i6dfobofu652e27f5hx6y5cpj7rgyd[.]com

PhishDestroy identifies an active Kraken brand impersonation threat linked to kraken3yvbvzmhytnrnuhsy772i6dfobofu652e27f5hx6y5cpj7rgyd.com, posing as the legitimate Kraken cryptocurrency exchange to deceive users into entering sensitive credentials or payment details. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on October 23, 2023, and currently resolves to IP 188.114.96.3. Its SSL certificate is issued by Google Trust Services, adding a false sense of legitimacy to the fraudulent site. This domain was flagged by 4 out of 95 security vendors on VirusTotal, indicating limited but notable detection coverage. Its recent creation and the use of a trusted SSL issuer suggest an attempt to evade initial scrutiny by automated security tools. The threat actor leverages the Kraken brand’s reputation to trick users into disclosing login credentials or cryptocurrency wallet information, potentially leading to financial loss or account compromise. If you visited this domain or entered any information, immediately change your Kraken account password and enable two-factor authentication. Review all recent transactions for unauthorized activity and consider revoking any connected API keys or third-party access. Use a reputable password manager to avoid autofill on untrusted sites. Report the domain to Kraken’s abuse team and your organization’s security team for further investigation.