krakenreferral[.]ca

The domain krakenreferral.ca has been identified as a brand impersonation phishing site targeting users of the cryptocurrency exchange Kraken. Analysis confirms the domain was designed to deceive victims by offering fraudulent referral rewards, specifically claiming to provide $50 or $75 for sign-ups. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented threat. Technical indicators reveal the domain was registered through CENTRALNIC CANADA INC on November 28, 2025, and resolved to the IP address 172.66.0.70, associated with Cloudflare, Inc. (AS13335). Security vendor analysis on VirusTotal shows 17 of 95 engines flagged the domain as malicious, while it appeared on one security blocklist. The SSL certificate was issued by Google Trust Services, using the WE1 intermediate, a common obfuscation tactic in phishing infrastructure. The page title, 'Kraken Referral Code Canada - Get $50 or $75,' directly mimics legitimate promotional campaigns, increasing the likelihood of user engagement. Current status indicates the domain is offline, though residual risk persists due to potential re-activation or migration to alternate infrastructure. Organizations and users are advised to block the domain at the DNS or proxy level, monitor for similar naming patterns (e.g., 'krakenreferral' variants), and verify promotional offers exclusively through official Kraken channels. Security teams should correlate this domain with other indicators, such as the Cloudflare IP range and registrar data, to identify related threats. End-users should be educated on recognizing impersonation tactics, particularly those leveraging referral incentives or regional targeting (e.g., 'Canada').