www-kra21[.]cc

This website mimics the Kraken cryptocurrency exchange and lures visitors into entering their login credentials. When you attempt to sign in, the fake page captures your username and password, then sends them to cybercriminals who can steal your funds or use your account for further attacks. Even if the page looks identical to Kraken’s real site, it is a trap designed to harvest your sensitive data and compromise your digital wallet or exchange account.

PhishDestroy identifies this domain as part of a live phishing campaign targeting Kraken users. The site was created on December 09, 2024, and is already flagged by 4 out of 95 VirusTotal security vendors. It resolves to IP address 86.54.25.38 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a domain provider often abused in low-cost, short-lived phishing operations. The page title matches the domain exactly, which is a common tactic used by threat actors to appear legitimate at first glance.

If you visited www-kra21.cc, assume your login credentials have been compromised. Immediately change your Kraken password using the official website (kraken.com) and enable two-factor authentication if you haven’t already. Review your account for unauthorized transactions and consider revoking any API keys or third-party integrations you may have set up. Use a password manager to ensure you’re using strong, unique passwords and avoid entering credentials on any site that seems even slightly off—like one that doesn’t use HTTPS or has unusual domain spelling or extensions.