mail[.]kraken[.]net[.]bo

Analysis of the domain mail.kraken.net.bo indicates an active high‑risk brand‑impersonation campaign targeting Kraken users. The domain was registered on February 28, 2026 and resolves to the IP address 190.129.114.119, which is assigned to ASN 6568 (EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA) in Bolivia. An SSL certificate issued by Let’s Encrypt (R13) secures the site, and HTTP requests return a 200 status code. The web server is identified as Nginx with HTTP Strict Transport Security (HSTS) enabled.

The page title reported by the scanner is "mail.kraken.net.bo - mail UI," confirming the presence of a mail‑style interface. Reputation scoring from Gridinsoft assigns a zero‑out‑of‑hundred trust score, reflecting extreme suspicion. VirusTotal analysis shows that four of ninety‑three security vendors flag the domain, and the domain appears on three public blocklists, specifically PhishDestroy, MetaMask, and SEAL. The campaign is classified as a crypto scam, leveraging the Kraken brand to deceive victims.

While the exact phishing kit or login capture mechanism has not been disclosed, the combination of a newly created domain, low trust score, multiple vendor detections, and blocklist listings strongly suggests a malicious intent. Defenders should block the domain and its hosting IP at network perimeters, update intrusion detection signatures to include the observed URL patterns, and monitor for outbound connections to the identified IP. Continuous re‑evaluation is advised, as additional indicators such as malware payloads or credential harvesting techniques may emerge as the campaign evolves.