kraken2steam[.]net

Analysis as of July 20, 2026 indicates that the domain kraken2steam.net was registered on July 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. The domain resolves to the IP address 172.67.184.154 and is served by Cloudflare, as evidenced by the authoritative name servers newt.ns.cloudflare.com and sneh.ns.cloudflare.com. The infrastructure has been observed on a single security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal reports that 2 of 91 scanned security vendors flagged the domain, confirming a low‑to‑moderate detection rate but reinforcing its malicious classification as a generic phishing operation. No additional public intelligence such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts has been published, leaving the exact content and target brand of the phishing lure unknown. The short lifespan of the domain—only five days since registration—combined with its rapid appearance on blocklists suggests an opportunistic campaign that may be exploiting current events or trending topics. Defenders should immediately add kraken2steam.net to outbound and inbound filtering rules, enforce DNS‑based blocklisting, and consider blocking the associated Cloudflare IP range if broader mitigation is required. Continuous monitoring of the IP address 172.67.184.154 for new activity, as well as periodic re‑scans on VirusTotal and other sandbox services, is recommended to detect any evolution of the payload or additional indicators of compromise. Given the limited public data, threat hunters should also query passive DNS and certificate transparency logs for related domains that share the same nameservers or registration details, as these may reveal a larger malicious infrastructure.