kra40at[.]com

This domain, kra40at.com, is flagged as a brand-impersonation threat targeting the Kraken cryptocurrency exchange. Analysis of the page title, KRAKEN ✅, and domain structure indicates an attempt to deceive users into entering login credentials, likely followed by secondary authentication factors. No drainer kit signatures were detected in initial scans, but the presence of a fabricated login interface aligns with credential harvesting campaigns observed in recent cryptocurrency phishing operations. Infrastructure analysis reveals the domain was registered on February 07, 2025, through NiceNIC International Group Co., Limited. It resolves to IP address 104.21.43.75, hosted on Cloudflare’s network (AS13335). VirusTotal detection shows 11 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently not listed in Google Safe Browsing databases. The SSL certificate, issued by Let’s Encrypt (serial E7), provides HTTPS encryption but does not validate legitimacy. The domain has been taken offline, reducing immediate risk to users. However, residual risk remains due to potential credential reuse by attackers. Users who interacted with the site are advised to rotate passwords, revoke active sessions, and enable hardware-based multi-factor authentication. Organizations should monitor for credential-stuffing attempts using harvested data. The domain’s infrastructure, including registrar and hosting provider, has been reported for takedown, but threat actors may deploy similar domains using comparable naming patterns.