gp[.]lb67[.]a-hca[.]tapf8[.]unu[.]kraken[.]storeweb2002[.]com[.]br

This domain, gp.lb67.a-hca.tapf8.unu.kraken.storeweb2002.com.br, is flagged for high-risk brand impersonation phishing targeting Kraken, a well-known cryptocurrency exchange platform. Analysis indicates the domain was constructed to mimic legitimate Kraken infrastructure, likely to deceive users into divulging credentials or transferring assets. No specific drainer kit signatures have been confirmed, but the subdomain structure and naming conventions align with known phishing campaigns impersonating financial services. The inclusion of 'kraken' in the subdomain path is a deliberate tactic to exploit brand recognition and user trust. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, and resolves to the IP address 51.75.195.124, hosted on AS16276 (OVH SAS) in France. It holds a valid Let's Encrypt SSL certificate (R12), which is commonly abused to lend an appearance of legitimacy. The domain is currently flagged by 10 out of 95 security vendors on VirusTotal, and it appears on three independent security blocklists. Google Safe Browsing (GSB) status is not explicitly provided, but the domain has been blocked by multiple sector-specific threat intelligence feeds, including those focused on financial fraud and cryptocurrency threats. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by hosting providers or domain registrars following abuse reports. While the immediate threat has been mitigated, residual risk remains for users who may have interacted with the domain prior to its takedown. Organizations and individuals are advised to monitor for unauthorized access attempts, revoke any compromised credentials, and implement domain-based blocking rules for similar patterns. Continuous vigilance is recommended, as threat actors frequently rotate infrastructure to evade detection.