krakenka[.]com

This domain, krakenka.com, is identified as a high-risk brand impersonation threat specifically targeting users of the Kraken cryptocurrency exchange. Analysis indicates the site replicates Kraken’s official interface, likely to harvest login credentials, two-factor authentication codes, or initiate unauthorized transactions. No specific drainer kit signatures have been confirmed at this time, but the site’s structure aligns with common phishing frameworks used in cryptocurrency theft campaigns. Infrastructure analysis reveals the domain was registered on September 23, 2025, through GoDaddy.com, LLC. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). Security vendor detections on VirusTotal stand at 14/95, with Google Safe Browsing explicitly flagging the domain as phishing. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to malicious sites. As of the latest assessment, krakenka.com remains active and continues to resolve to its Cloudflare-hosted IP. The domain’s recent creation date and low initial detection rate suggest it may still be in the early stages of deployment, increasing the risk of undetected compromise for unsuspecting users. Immediate mitigation actions include blocking the domain and IP at the network level, updating endpoint protection rules, and alerting users to verify URLs before entering credentials. Despite these measures, the domain’s use of Cloudflare infrastructure and valid SSL certificate may allow it to evade some automated defenses, necessitating ongoing monitoring for new indicators of compromise.