krab1[.]ltd

The domain krab1.ltd has been identified as a brand impersonation phishing domain specifically targeting Kraken, a well-known cryptocurrency exchange. This domain is currently offline, having been taken down after security researchers flagged its malicious intent. The page title found on the domain was simply 'Kraken,' indicating a direct attempt to mimic the legitimate platform and deceive users into entering sensitive information.

According to available intelligence, krab1.ltd was flagged by 5 out of 95 VirusTotal security vendors, and it appears on one security blocklist. The domain was registered through NiceNIC International Group Co., Limited and resolves to the IP address 193.105.134.82. It was created on December 9, 2025, and notably lacks an SSL certificate, which is a common red flag for phishing sites. These technical indicators, combined with the low vendor detection rate, suggest that while the domain has been recognized as malicious, it may have evaded broader detection for a period.

Given that the domain has already been taken offline, the immediate risk is mitigated. However, users should remain vigilant, as similar domains may appear in the future. PhishDestroy recommends that users always verify the authenticity of any site claiming to be Kraken by checking the URL carefully and ensuring it uses a valid SSL certificate. Additionally, enabling multi-factor authentication on cryptocurrency accounts can provide an extra layer of protection against credential theft. If you have interacted with this domain, change your passwords immediately and monitor your accounts for suspicious activity.