kraken20-att[.]com

The domain kraken20-att.com has been identified as a brand impersonation threat targeting the cryptocurrency exchange Kraken. Analysis confirms this domain was designed to deceive users by mimicking legitimate Kraken infrastructure, falling under the specific threat category of brand impersonation. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, and resolved to the IP address 185.226.92.168, located in Turkey. Detection metrics indicate the domain was flagged by 17 of 95 security vendors on VirusTotal, reflecting elevated risk. Additionally, the domain appears on one security blocklist and was previously blocked by PhishDestroy. Notably, the domain lacked an SSL certificate, a common red flag for fraudulent sites. The hosting provider, BIGCORE, has been associated with other malicious infrastructure in prior campaigns. Current status confirms kraken20-att.com is offline, reducing immediate risk to end users. However, organizations are advised to monitor for residual exposure, particularly among users who may have interacted with the domain during its active period. Network defenders should update blocklists to include the domain and its associated IP (185.226.92.168) to prevent future access attempts. Users who may have entered credentials or sensitive information on the site are urged to rotate passwords and enable multi-factor authentication on all related accounts. Proactive threat hunting for related indicators of compromise is recommended to identify any lingering exposure.