krakenlogi[.]my[.]canva[.]site

The domain krakenlogi.my.canva.site has been identified as a high-risk phishing portal specifically designed to impersonate Kraken, a cryptocurrency exchange platform. Analysis indicates this infrastructure functions as a brand impersonation scheme, likely intended to harvest user credentials or distribute crypto-draining malware. The domain is currently offline, though prior activity suggests it was actively targeting users seeking Kraken-related services. Infrastructure analysis reveals the domain was registered through Gandi SAS on April 03, 2018, and resolved to the IP address 103.169.142.6, hosted under AS209242 (Cloudflare London, LLC) with an Australian geolocation tag. Security telemetry shows the domain was flagged by 11 of 95 vendors on VirusTotal, while Google Safe Browsing categorized it as phishing. The SSL certificate, issued by Google Trust Services (WE1), provided a false sense of legitimacy. The domain appeared on three independent security blocklists and was proactively blocked by at least three additional threat intelligence feeds, including those specializing in cryptocurrency fraud detection. Current status indicates the domain has been taken offline, though similar infrastructure may re-emerge under different aliases. Organizations and users are advised to treat any unsolicited communications referencing Kraken with heightened scrutiny, particularly those directing to non-official domains. Network-level protections should be updated to include the resolved IP (103.169.142.6) and associated indicators in perimeter defenses. Endpoint security solutions should be configured to detect and block brand impersonation attempts targeting cryptocurrency platforms, with emphasis on domains registered through high-risk registrars or leveraging content delivery networks for obfuscation.