kraken21-at[.]com

This domain, kraken21-at.com, is identified as a high-risk phishing infrastructure specifically designed to impersonate the Kraken cryptocurrency exchange platform. Analysis indicates the domain mimics legitimate Kraken branding to deceive users into disclosing sensitive credentials, including login details, two-factor authentication codes, and wallet recovery phrases. The threat primarily targets cryptocurrency holders, aiming to facilitate unauthorized access to digital assets and financial fraud through social engineering tactics. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on March 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious activity. It resolves to the IP address 188.114.97.3, hosted behind Cloudflare, Inc. in Canada, a common tactic to obscure server origins. Security vendors have flagged the domain in 13 out of 95 scans on VirusTotal, and it appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate, issued by Google Trust Services (WE1), further suggests an attempt to appear legitimate to unsuspecting users. Users who have visited kraken21-at.com or interacted with its content should take immediate remediation steps. Disconnect any active sessions and revoke access to linked cryptocurrency wallets or exchange accounts. Reset passwords and enable multi-factor authentication on all associated platforms. Monitor financial transactions for unauthorized activity and report the incident to relevant security teams or fraud prevention services. If credentials were entered, assume they are compromised and avoid reusing them across other services. Additionally, consider scanning local devices for malware, as phishing sites may distribute malicious payloads.