kraken21-at[.]net

Analysis of the domain kraken21-at.net indicates it is an active brand impersonation threat targeting the cryptocurrency exchange Kraken. Registered on January 29, 2024, through NiceNIC International Group Co., Limited, the domain currently resolves to the IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) and geolocated in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (princess.ns.cloudflare.com and sterling.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The domain is flagged by one security blocklist and has been classified as a crypto scam by detection engines. As of July 12, 2026, nine out of ninety-five security vendors on VirusTotal have identified the domain as malicious. The page title, 'KRAKEN,' aligns with the targeted brand, reinforcing the likelihood of fraudulent intent. The site returns an HTTP 302 redirect status, which may indicate an attempt to forward visitors to another malicious endpoint or evade automated detection tools. No SSL certificate is present, further reducing the domain's legitimacy. Defenders should treat kraken21-at.net as a high-risk domain due to its active status, brand impersonation, and detection by multiple security vendors. Network-level blocking of the IP 188.114.97.3 and monitoring for related domains registered through the same registrar may mitigate exposure. The exact content and functionality of the site remain unanalyzed, but the available indicators strongly suggest it is part of a fraudulent cryptocurrency scheme.