kra27-at[.]com

This domain, kra27-at.com, operates as a confirmed brand impersonation phishing site designed to deceive users of the Kraken cryptocurrency exchange platform. Analysis indicates the site mimics legitimate Kraken login interfaces, presenting a page titled KRAKEN to trick victims into entering sensitive credentials or financial details. Such impersonation campaigns frequently lead to unauthorized account access, cryptocurrency theft, or installation of malicious payloads under the guise of legitimate services. The domain’s infrastructure and content align with known tactics used in credential harvesting and crypto drainer schemes targeting digital asset platforms. Evidence supporting the malicious classification includes detection by 9 of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to the IP address 172.67.209.121, hosted behind Cloudflare, Inc. in Canada, a common obfuscation technique to conceal origin servers. The SSL certificate, issued by Google Trust Services (WE1), further suggests an attempt to appear legitimate while masking the true intent of the operation. Users who accessed kra27-at.com should immediately revoke any entered credentials and enable multi-factor authentication on their Kraken accounts. All sessions associated with the domain should be terminated, and any installed browser extensions or downloaded files linked to the site must be removed. System scans using updated security tools are recommended to detect potential malware. Affected individuals should monitor their accounts for unauthorized transactions and report the incident to the targeted platform’s security team for further mitigation.