kraken-login[.]ru

This domain, kraken-login.ru, represents an active brand impersonation campaign designed to deceive users of the Kraken cryptocurrency exchange platform. Analysis indicates the site attempts to harvest login credentials, potentially enabling unauthorized access to digital asset wallets and trading accounts. The infrastructure mimics legitimate Kraken authentication portals, employing visual and structural elements to trick victims into submitting sensitive information such as usernames, passwords, and two-factor authentication codes. Given the elevated risk level, this domain likely serves as a precursor to broader financial fraud or crypto drainer operations targeting compromised accounts. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on May 12, 2025, through BEGET-RU, a registrar frequently associated with fraudulent activity. It resolves to the IP address 45.130.41.168, which has been linked to prior phishing campaigns. Detection metrics further substantiate the threat: VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist. The page title, 'This domain is not linked to any directory on the server!', suggests either a placeholder configuration or an attempt to evade automated detection systems by presenting minimal content. Users who have visited kraken-login.ru or entered credentials on this domain should take immediate remedial action. First, revoke access to any sessions or devices associated with the compromised account and enable multi-factor authentication if not already active. Monitor the account for unauthorized transactions, address changes, or API key modifications. Reset passwords not only for Kraken but also for any other platforms where identical or similar credentials may have been reused. Report the incident to Kraken’s official security team and consider filing a complaint with relevant cybercrime authorities. Given the domain’s current offline status, users should remain vigilant for follow-up phishing attempts via email or alternative domains impersonating Kraken.