kraken-14--at[.]net

PhishDestroy identifies kraken-14--at.net as an active brand impersonation scam targeting Kraken cryptocurrency exchange users. The domain leverages visual and textual deception to trick victims into divulging credentials or payment details under the guise of a legitimate platform.
kraken-14--at.net presents an elevated risk due to its confirmed impersonation of Kraken and partial detection coverage across security vendors. VirusTotal reveals 6 out of 95 security engines flagged the domain as malicious as of the latest analysis. The domain was registered on April 04, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with bulk and privacy-protected registrations that can obscure malicious ownership. It resolves to IP address 188.114.97.3, a hosting infrastructure linked to multiple low-trust activities. Despite hosting suspect content, the domain holds an SSL certificate issued by Google Trust Services, which alone cannot validate legitimacy. The combination of recent creation date, registrar profile, and low detection rate underscores its potential to evade early detection while posing immediate risk to uninformed users.
This threat type—brand impersonation—relies on exploiting user trust in well-known brands. To mitigate exposure, organizations and users should: block kraken-14--at.net at DNS and network levels using threat intelligence feeds; educate users to verify domain spelling, HTTPS indicators, and official Kraken domains (e.g., kraken.com); and deploy browser-based warnings using real-time threat feeds. Immediate isolation or takedown requests should be escalated to hosting providers and registrars referencing the domain, registration date, and resolving IP. Given the active status and low detection rate, proactive blocking is essential to prevent credential harvesting or malware delivery under the Kraken brand.