kraken11-at-kra[.]com

This domain, kraken11-at-kra.com, is identified as a brand impersonation threat specifically targeting Kraken, a well-known cryptocurrency exchange platform. The site is designed to deceive users into believing they are interacting with legitimate Kraken services, likely for the purpose of credential harvesting or crypto asset theft. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical and analytical purposes. Analysis indicates the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated creation that may suggest registry manipulation or a placeholder entry. It resolved to the IP address 185.226.92.168, located in Turkey under the hosting provider BIGCORE. The domain appears on one security blocklist and has been flagged by 15 of 95 security vendors on VirusTotal, indicating a moderate to elevated level of detection. The SSL certificate was issued by Let's Encrypt (R13), a common choice among threat actors due to its free and automated issuance process, which lacks stringent identity verification. Infrastructure analysis reveals that this domain was part of a targeted phishing campaign aimed at cryptocurrency users. The use of a Let's Encrypt certificate, combined with the domain's naming convention—incorporating both 'kraken' and a numeric suffix—is consistent with tactics used to evade basic detection while maintaining a veneer of legitimacy. Organizations and individuals are advised to block the domain and its associated IP at the network level, monitor for any re-emergence under similar naming patterns, and educate users on recognizing brand impersonation attempts. Historical logs should be reviewed for any interactions with this domain, particularly within the cryptocurrency and financial sectors.