kraken-6[.]s3f[.]click

PhishDestroy identifies kraken-6.s3f.click as an active brand impersonation site targeting Kraken cryptocurrency exchange users. This domain was flagged on February 26, 2026—less than 24 hours old at the time of detection—yet it already resolves to 104.21.89.100 using a Let’s Encrypt SSL certificate, creating a false sense of legitimacy. While VirusTotal currently shows 0 detections out of 95 engines, the site is engineered to harvest login credentials through fake login pages that mirror Kraken’s official interface. Attackers may then drain wallets or sell stolen accounts on dark-web markets. This impersonation is registered through Spaceship, Inc., a domain host known for rapid provisioning of lookalike names rather than traditional registrars. The combination of a fresh registration date, low detection rate, and infrastructure tied to a hosting provider often abused for quick-turn phishing campaigns indicates high risk despite the current zero score. The domain name itself follows a common pattern—kraken-6.s3f.click—using a subdomain structure and random string to bypass simple keyword filters. Traffic is routed through Cloudflare (AS13335), which can mask the true origin but does not validate the site’s legitimacy. If you visited kraken-6.s3f.click or entered any information, immediately revoke any session cookies or API keys associated with Kraken, enable two-factor authentication if not already active, and consider transferring funds to a cold wallet. Scan your device for malware using a reputable antivirus and change passwords only after confirming you are on the official kraken.com domain. Report the incident to Kraken support with timestamps and any screenshots. Monitor your accounts closely for unauthorized withdrawals over the next 72 hours and consider freezing outgoing transactions as a precaution. This domain remains under active monitoring and will be updated as new threat data emerges.