kraken6-at[.]xyz

This domain is flagged as a targeted impersonation site designed to deceive users of the Kraken cryptocurrency exchange. The site mimics legitimate Kraken login and transaction pages to harvest credentials, wallet addresses, and two-factor authentication codes. Victims may unknowingly submit sensitive account details, leading to unauthorized access, asset theft, or complete account compromise. The fraudulent nature of the site extends to phishing for recovery phrases and private keys, which could result in irreversible financial losses for affected users. Analysis indicates the domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure review reveals the site resolves to IP address 172.67.185.173, hosted behind Cloudflare in Canada, a common tactic to obscure origin and evade detection. Security vendor assessments on VirusTotal show 10 out of 95 engines flagging the domain as malicious, with one blocklist (PhishDestroy) explicitly listing it for brand impersonation. The SSL certificate, issued by Google Trust Services, uses the WE1 intermediate, which is standard but does not mitigate the underlying fraudulent intent. If you visited kraken6-at.xyz or entered any credentials, take immediate action to secure your account. First, terminate any active sessions and disconnect connected devices or applications. Reset your Kraken account password using a strong, unique passphrase and enable all available security measures, including hardware-based two-factor authentication. Review recent transactions for unauthorized activity and report any suspicious entries to Kraken support. Monitor linked email accounts and financial services for signs of compromise, and consider revoking API keys or third-party access until the account is verified as secure. Users should also scan local devices for malware, as phishing sites may deploy keyloggers or remote access tools.