web-kraken-support[.]created[.]app

This domain, web-kraken-support.created.app, operates as a confirmed phishing portal targeting users of the Kraken cryptocurrency exchange. Analysis indicates the site presents a fraudulent login interface mimicking Kraken’s legitimate platform, with the page title "Login - Kraken | Buy, Sell and Trade Cryptocurrency." The primary threat involves credential harvesting, where attackers collect login credentials to gain unauthorized access to victims' cryptocurrency wallets or exchange accounts, potentially leading to financial theft or further exploitation via crypto drainer scripts. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on July 12, 2023, through Tucows Domains Inc., and resolves to the IP address 216.150.1.1, hosted on Amazon.com, Inc. infrastructure (AS16509). VirusTotal detections show 10 out of 95 security vendors flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate is issued by Let’s Encrypt (R13). The site was subsequently taken offline, though its prior activity remains a confirmed threat. Users who visited web-kraken-support.created.app or entered credentials on the site should immediately take corrective action. First, revoke any active sessions on the legitimate Kraken platform and change passwords using a secure, unrelated device. Enable multi-factor authentication (MFA) if not already active. Monitor account activity for unauthorized transactions and report suspicious behavior to Kraken’s official support channels. If cryptocurrency transactions were initiated, consider contacting the receiving exchange to attempt freezing funds. Devices used to access the site should undergo a full security scan to detect potential malware or backdoors.