kra12[.]ink

This domain, kra12.ink, is identified as a brand impersonation threat specifically targeting users of the Kraken cryptocurrency exchange platform. The page title, Авторизация Kraken, directly mimics the authentication interface of the legitimate service, aiming to deceive users into entering credentials or sensitive financial information. Such impersonation attacks are commonly used to harvest login details, which may lead to unauthorized account access, financial theft, or further exploitation through social engineering tactics. Analysis indicates the domain was registered on February 21, 2026, through NameCheap, Inc., a registrar frequently observed in malicious infrastructure. The domain resolves to the IP address 188.114.96.3 and is associated with an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Security telemetry reveals that kra12.ink appears on three distinct blocklists and is flagged by 4 out of 95 security vendors on VirusTotal, confirming its malicious classification. The domain has since been taken offline, though residual risk remains for users who may have interacted with it prior to its deactivation. Users who visited kra12.ink or entered credentials on the site should immediately revoke any active sessions on the legitimate Kraken platform and reset their account passwords using a secure, unrelated device. Multi-factor authentication (MFA) tokens or recovery codes should be regenerated, and all connected devices should be scanned for malware or unauthorized access. Financial transactions conducted during the exposure window should be reviewed for anomalies, and any suspicious activity reported to the platform’s security team. Organizations should update internal blocklists to include this domain and monitor network logs for connections to 188.114.96.3 or related indicators of compromise.