kra38at[.]com

Analysis of kra38at.com indicates a high-risk phishing domain targeting cryptocurrency users, specifically mimicking the Kraken exchange as suggested by the page title 'kra38.at'. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 188.114.96.3. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which are commonly employed to obscure hosting details and evade detection. The SSL certificate is issued by Google Trust Services, a legitimate provider often exploited in phishing operations to appear trustworthy. The domain is actively flagged by multiple security sources: it appears in 22 AlienVault OTX threat intelligence pulses and is listed on four security blocklists. Detection engines, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, have classified this domain as malicious. While the exact content of the site has not been analyzed, the page title and widespread blocking by crypto-focused security tools strongly suggest it is designed to deceive users into disclosing credentials or transferring assets. Defenders should treat this domain as confirmed malicious infrastructure. Immediate actions include blocking the domain and IP at network and endpoint levels, monitoring for connections to 188.114.96.3, and alerting users to potential phishing attempts referencing Kraken or similar branding. Given the domain's recent registration and active status, further monitoring for related domains or IP shifts is recommended.