kraken13at[.]de

PhishDestroy identifies kraken13at.de as an active brand impersonation domain targeting Kraken users. This domain employs a drainer kit to harvest credentials and cryptocurrency from victims who believe they are interacting with Kraken’s official platform. The threat actor leverages the domain’s superficial resemblance to the legitimate brand to deceive users into entering sensitive information or authorizing fraudulent transactions.

This domain was flagged with a VirusTotal score of 1/95 security vendors, indicating low detection but high potential for malicious activity. It utilizes a ZeroSSL certificate for deceptive legitimacy, resolves to the IP 46.224.226.202, and is linked to a known threat infrastructure. While the exact registrar and creation date are not disclosed in this data, its active status and low VT detection rate suggest recent deployment as part of a targeted campaign. The domain remains unblocked by Google Safe Browsing (GSB) and has not yet been widely added to threat intelligence blocklists, leaving users vulnerable to exposure.

kraken13at.de remains active as of the latest assessment, with no confirmed takedown or mitigation by hosting providers. Users are strongly advised to avoid interacting with this domain and report any encountered instances to Kraken’s official security channels. Remaining risk is elevated due to the domain’s active status, low detection rate, and the use of SSL encryption to appear legitimate. Immediate action includes blocking the IP 46.224.226.202 at the network level and updating endpoint protections to flag kraken13at.de. Security teams should monitor for related infrastructure and coordinate with threat intelligence platforms for broader dissemination.