kraken189[.]net

This domain, kraken189.net, poses a high-risk brand impersonation threat specifically targeting users of the Kraken cryptocurrency exchange platform. Analysis indicates the site was designed to replicate Kraken's official interface, likely to harvest login credentials, two-factor authentication codes, or deploy crypto-draining malware. The domain's infrastructure and content suggest a focused campaign to exploit trust in the Kraken brand, potentially leading to unauthorized asset transfers or account takeovers for victims. Infrastructure analysis reveals the domain was registered on December 10, 2025, through Dynadot LLC, a registrar frequently observed in malicious campaigns. It resolves to the IP address 184.94.213.243, hosted on AS22612 (Namecheap, Inc.) infrastructure in the United States. The site's SSL certificate, issued by Sectigo Limited, provides a false sense of security while being flagged by 19 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist and is explicitly categorized as phishing by Google Safe Browsing. The page title 'Default Web Site Page' suggests either incomplete deployment or an attempt to evade automated detection systems. Users who visited kraken189.net should immediately revoke any active sessions on the legitimate Kraken platform and enable all available security measures, including hardware-based two-factor authentication. All credentials potentially exposed to this domain should be considered compromised and reset across any other platforms where they may have been reused. Affected individuals are advised to monitor their Kraken accounts for unauthorized transactions and report any suspicious activity to the exchange's official support channels. Given the high-risk nature of this campaign, users should also scan their devices for malware using updated security tools to detect any secondary payloads that may have been delivered.