web-kraken-do[.]zapier[.]app

This domain, web-kraken-do.zapier.app, has been assessed at an elevated risk level due to its specific threat type: brand impersonation of the cryptocurrency exchange Kraken. The page title, 'Kraken: Buy and sell securely,' was crafted to deceive users into believing they were visiting a legitimate Kraken platform, making it a convincing lure for credential theft or financial fraud.

Technical indicators paint a clear picture of malicious intent. VirusTotal flagged the domain with 18 out of 95 security vendors, and it appears on one security blocklist. The domain resolves to IP address 64.239.109.65, was registered through Name.com, Inc., and its SSL certificate was issued by Let's Encrypt (R12). Despite being taken offline, these details remain critical for threat hunting. The use of a legitimate certificate authority and a reputable registrar are common tactics to evade initial suspicion.

For users who may have encountered this phishing site, immediate action is recommended. Those who entered credentials on the fake Kraken page should change their passwords and enable two-factor authentication on their real Kraken accounts. Additionally, monitor accounts for unauthorized transactions and report the incident to Kraken's security team. Organizations should block the domain and associated IP across their networks and educate users about verifying URLs before entering sensitive information.