dosidicus[.]kraken[.]malwarebox[.]eu

The domain dosidicus.kraken.malwarebox.eu, which impersonates the cryptocurrency exchange Kraken, has been flagged by 6 out of 91 vendors on VirusTotal. It is also listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. The site is currently offline, reducing immediate risk, but its previous activity highlights the ongoing threat of phishing attacks targeting cryptocurrency platforms.

Registered through Namecheap, Inc., the domain was set up with SSL certification from Let's Encrypt, indicating an attempt to appear legitimate. The hosting IP, 51.77.44.29, was used to serve phishing content aimed at deceiving users into divulging sensitive information under the guise of Kraken's branding. The takedown of the site limits its reach, but the initial detection underscores the importance of rapid response to emerging threats.

Despite the site being offline now, the fact that it was flagged by multiple security vendors and blocklists shows the effectiveness of collaborative threat intelligence efforts. PhishDestroy's inclusion of the domain in its blocklist, alongside other security entities, highlights the critical role of real-time threat detection and information sharing in mitigating phishing risks. The case of dosidicus.kraken.malwarebox.eu serves as a reminder of the persistent threat phishing poses to digital assets and the need for continuous vigilance in cybersecurity practices.