kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7instadl[.]com

This domain, kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7instadl.com, is flagged as an elevated-risk brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic legitimate Kraken services, likely to deceive users into disclosing sensitive credentials or transferring digital assets. No direct evidence of a drainer kit was observed, but the domain structure and naming convention align with known phishing tactics in the crypto sector. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3, hosted by a provider known for anonymization services. VirusTotal reports 12 out of 95 security vendors detecting the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to unsuspecting users. Google Safe Browsing (GSB) does not currently list the domain, but this does not preclude its prior or future malicious use. As of the latest assessment, the domain has been taken offline, reducing immediate exposure. However, the infrastructure remains registered and could be reactivated or repurposed for similar campaigns. Organizations and users are advised to monitor for related domains using the same registrar or IP range, as threat actors often reuse infrastructure. Blocking the domain and its associated IP at the network level is recommended as a precautionary measure. Given the elevated risk, users who may have interacted with the domain should verify account integrity and rotate credentials.