kraken20[.]icu

This domain, kraken20.icu, is flagged for brand impersonation targeting Kraken, a major cryptocurrency exchange platform. Analysis indicates the site was designed to mimic legitimate Kraken login and transaction pages, likely to harvest user credentials or facilitate unauthorized fund transfers. No specific drainer kit signatures were identified in available telemetry, but the domain structure and timing suggest a targeted phishing campaign. Infrastructure analysis reveals the domain was registered on October 29, 2025, through Edomains LLC and resolves to the IP address 199.59.243.228. It employs Cloudflare for hosting and uses an SSL certificate issued by Google Trust Services. VirusTotal reports 0 detections out of 95 security engines, indicating the domain had not been widely flagged at the time of analysis. The domain appears on a single security blocklist and was proactively blocked by at least one threat intelligence feed. The page title, matching the domain name, further suggests a lack of effort to disguise the fraudulent nature of the site. As of the latest assessment, kraken20.icu has been taken offline, reducing immediate exposure to end users. However, the domain remains registered and could be reactivated or repurposed for future malicious activity. Organizations are advised to monitor for DNS resolution attempts to 199.59.243.228 and review logs for connections to the domain prior to its takedown. Security teams should update blocklists to include this domain and its associated IP, while users should be alerted to verify URLs before accessing cryptocurrency platforms.