kraken8at[.]shop

PhishDestroy identifies kraken8at.shop as a live domain engaged in active brand impersonation, specifically targeting the Kraken cryptocurrency exchange. Current telemetry confirms the domain remains unflagged by signature-based defenses despite ongoing malicious hosting operations. The site leverages deceptive visual cues and Kraken’s branding to deceive visitors into entering sensitive credentials or initiating unauthorized transactions.

Detailed forensic analysis reveals several concerning technical indicators tied to kraken8at.shop. The domain resolves to IP 188.114.97.3 and is secured via a Google Trust Services SSL certificate, which may enhance user trust while concealing malicious intent. Notably, VirusTotal currently reports 0 detections out of 95 participating vendors, indicating a low detection rate and highlighting the stealth of this campaign. The domain was registered recently, though exact creation date is not publicly disclosed via current WHOIS data. Registrar affiliation remains unverified in open sources, and the domain has not yet appeared on major threat intelligence blocklists such as PhishTank or OpenPhish. Trust scores from security vendors are absent due to the low detection count.

Given the absence of vendor detections and the high-risk nature of brand impersonation targeting a major cryptocurrency platform, the threat level is assessed as active and evolving. This domain should be treated as malicious until further evidence suggests otherwise. Immediate action includes blocking the domain at DNS and network levels, flagging the associated IP (188.114.97.3), and reporting the domain to threat intelligence platforms. Users are advised to avoid interaction and report any sightings to their security teams. Continuous monitoring is strongly recommended due to the potential for rapid takedown or shift in infrastructure.