kra16cc-kraken[.]com

This domain, kra16cc-kraken.com, is confirmed to pose a brand impersonation threat targeting users of the Kraken cryptocurrency exchange. Analysis indicates the site was designed to mimic legitimate Kraken login and trading interfaces, likely to harvest credentials or distribute crypto-draining malware. The infrastructure was structured to deceive users into believing they were interacting with the official Kraken platform, increasing the risk of unauthorized access to accounts or financial theft through fraudulent transactions or malicious scripts embedded in the site. Evidence supporting this assessment includes detection by 14 out of 95 security vendors on VirusTotal, a metric that underscores the domain's malicious nature. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, and resolved to the IP address 185.226.92.168, located in Turkey and associated with the hosting provider BIGCORE. Additionally, the domain appears on one security blocklist, further validating its classification as a phishing threat. The SSL certificate issued by Let's Encrypt (R12) was likely used to lend a false sense of legitimacy to the fraudulent site. Users who visited kra16cc-kraken.com should immediately revoke any active sessions on the legitimate Kraken platform and change their account passwords. If credentials were entered on the site, enable multi-factor authentication (MFA) on all linked accounts and monitor for unauthorized transactions or login attempts. Devices used to access the domain should be scanned for malware, as the site may have attempted to deliver malicious payloads. Financial institutions and cryptocurrency wallets associated with the account should be notified to flag potential fraudulent activity. Given the domain's current offline status, users should remain vigilant for similar phishing attempts targeting Kraken or other cryptocurrency services.