vhod-na-kraken[.]help

This domain, vhod-na-kraken.help, operates as a credential harvesting platform specifically targeting users of the Kraken cryptocurrency exchange. The site presents itself as an official link monitoring service for Kraken, with the page title 'Мониторинг официальных ссылок на маркетплейс Кракен,' designed to deceive users into entering sensitive account credentials. The fraudulent infrastructure mimics legitimate exchange portals, likely capturing usernames, passwords, and two-factor authentication codes for subsequent unauthorized account access and financial theft. Analysis indicates the domain was registered on March 28, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate financial services. It resolves to the IP address 188.114.97.3, which is associated with Cloudflare's network, a common tactic to obscure hosting origins. The domain appears on two security blocklists and is flagged by 7 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. Technical indicators reveal the use of WordPress, MySQL, PHP, and Google Analytics, alongside Cloudflare Browser Insights and HTTP/3, suggesting a sophisticated setup designed to evade basic detection mechanisms. Users who visited vhod-na-kraken.help should immediately assume their credentials were compromised. It is critical to revoke any active sessions on the legitimate Kraken platform, change passwords using a secure device, and enable multi-factor authentication if not already active. Monitor the associated Kraken account for unauthorized transactions and report any suspicious activity to the exchange's security team. Additionally, scan the device used to access the domain for malware, as phishing sites may deploy additional payloads to maintain persistence or capture further sensitive data.