krakenvn[.]top

This domain, krakenvn.top, is identified as a brand impersonation threat targeting users of the Kraken cryptocurrency exchange platform. Analysis indicates the site was designed to deceive visitors into entering sensitive credentials, such as login details, two-factor authentication codes, or private wallet keys, under the false pretense of accessing legitimate Kraken services. The domain’s infrastructure and content were crafted to closely mimic the official Kraken interface, increasing the likelihood of successful credential harvesting or financial fraud against unsuspecting users. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on March 28, 2025, through GoDaddy.com, LLC, and currently resolves to the IPv6 address 2606:4700:3037::6815:4979, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flagged the domain as malicious, with 10 out of 95 engines detecting it as a phishing or fraudulent site. Additionally, the domain appears on one security blocklist and is associated with an SSL certificate issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing pages. The page title, 'krakenvn.top | 522: Connection timed out,' suggests the site may have been abruptly taken offline, potentially due to enforcement actions or operational changes by the threat actor. Users who visited krakenvn.top or entered credentials on this domain should take immediate action to mitigate potential risks. First, revoke any active sessions on the legitimate Kraken platform and reset account passwords using a secure, unrelated device. Enable multi-factor authentication if not already active, and monitor the account for unauthorized transactions or changes. If cryptocurrency wallet details or private keys were entered, transfer assets to a new wallet immediately, as compromised keys can lead to irreversible theft. Report the incident to the official Kraken security team and consider filing a report with local cybercrime authorities. Infrastructure analysis reveals the domain is currently offline, but threat actors may re-establish similar infrastructure under a new domain or IP address.