krakengtm[.]tech

This domain, krakengtm.tech, was identified as part of a brand impersonation campaign targeting users of the Across protocol, a cross-chain bridging platform. The site presented itself as a legitimate capability assessment portal under the title 'Kraken GTM Capability Assessment,' employing visual and thematic elements designed to mimic official Across branding. Analysis indicates the domain was structured to deceive users into engaging with fraudulent interfaces, potentially leading to unauthorized access to cryptocurrency wallets or the execution of malicious transactions through social engineering tactics. Infrastructure analysis reveals the domain was registered on March 4, 2026, through Go Daddy, LLC, a common registrar for both legitimate and malicious domains. It resolved to the IP address 185.158.133.1 and was protected by Cloudflare, which obscured backend details and provided SSL encryption via Google Trust Services. Despite its deceptive design, the domain exhibited limited detection at the time of analysis, with 0 out of 95 security engines on VirusTotal flagging it as malicious. However, it appeared on four security blocklists, including those maintained by browser extensions and threat intelligence feeds, suggesting prior identification by automated systems or manual review. Users who visited krakengtm.tech or interacted with its content are advised to take immediate remedial actions. Any credentials, wallet addresses, or transaction details entered on the site should be considered compromised. Affected individuals should revoke access to any connected decentralized applications, monitor their accounts for unauthorized activity, and conduct a thorough security review of associated devices. Given the domain's offline status, further interaction is unlikely, but vigilance is recommended for similar impersonation attempts targeting the Across protocol or related services.