kraken[.]mrdreix[.]dev

This domain, kraken.mrdreix.dev, poses a high-risk brand impersonation threat targeting Kraken users. Analysis indicates the site mimics the legitimate Kraken cryptocurrency exchange platform, presenting a page titled 'Kraken — cenové ponuky' (Slovak for 'Kraken — price offers'). The domain is designed to deceive users into submitting login credentials, API keys, or other sensitive financial information under the false pretense of accessing Kraken services. The inclusion of localized content suggests a targeted campaign aimed at Slovak-speaking users, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain resolves to the IP address 64.29.17.65, with VirusTotal reporting 2 out of 95 security vendors flagging it as malicious. The domain appears on three distinct security blocklists, and Google Safe Browsing has explicitly classified it as a phishing site. While the exact registrar and creation date are not provided in the available data, the active status and blocklist presence indicate ongoing malicious activity. The low detection rate on VirusTotal (2/95) may reflect evasion techniques or recent deployment, underscoring the need for heightened vigilance. Users who have visited kraken.mrdreix.dev should immediately cease all interaction with the site and assume their credentials or financial data may have been compromised. Affected individuals should revoke any active sessions on the legitimate Kraken platform, enable multi-factor authentication if not already active, and monitor their accounts for unauthorized transactions. Additionally, users should scan their systems for malware, as phishing sites often redirect to secondary payloads. If API keys or other sensitive information were entered, these should be regenerated immediately. Network administrators are advised to block the domain and associated IP (64.29.17.65) at the perimeter to prevent further exposure.