krabl5[.]cc

The domain krabl5.cc has been identified as a brand_impersonation threat specifically targeting Kraken, a cryptocurrency exchange platform. Analysis confirms the domain is currently offline, though prior activity indicates malicious intent to deceive users by mimicking legitimate Kraken services. The threat type falls under credential harvesting and fraudulent financial activity, leveraging brand trust to exploit victims. Infrastructure analysis reveals krabl5.cc was flagged by 5 of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 28, 2026, an unusually future-dated creation that may suggest registry manipulation or typo-squatting tactics. It resolves to the IP address 172.67.175.2 and appears on one security blocklist. The domain holds a Gridinsoft trust score of 0/100, reinforcing its high-risk classification. Detected technologies include Cloudflare, Cloudflare Browser Insights, and HTTP/3, suggesting the use of content delivery networks to obfuscate hosting origins. The SSL certificate is issued by Google Trust Services, a common but not exclusive indicator of legitimate infrastructure. Current status confirms krabl5.cc has been taken offline, though the domain remains registered. Organizations and users are advised to block the domain at the DNS or network level as a precautionary measure. Security teams should monitor for re-registration or re-emergence under similar domain variations (e.g., krabl, krab5, or kraken-like typos). End-users should verify the authenticity of any communication or website claiming affiliation with Kraken by cross-referencing official domains and enabling multi-factor authentication on financial accounts. If credentials were entered on this domain, immediate password resets and account reviews are recommended.