kraken23at[.]net

PhishDestroy identifies kraken23at.net as an active brand impersonation domain targeting Kraken cryptocurrency exchange users. The domain masquerades as the legitimate Kraken platform, likely deployed to harvest credentials or facilitate crypto-draining operations through fraudulent deposit addresses. While no drainer kit fingerprint was detected in available telemetry, the page’s social engineering tactics align with known crypto-scam infrastructure designed to trick victims into transferring assets to attacker-controlled wallets. This domain was flagged by VirusTotal with a detection ratio of 1 out of 95 security vendors as of latest scan. It resolves to IP 188.114.96.3, is registered through Virtualia LLC, and went live on August 22, 2025. Despite hosting under a Google Trust Services SSL certificate, the page does not appear on Google Safe Browsing lists and remains currently unlisted on major blocklists, increasing exposure risk to unsuspecting users. Current status is active and elevated. Immediate defensive actions include adding both the domain and its IP to corporate blocklists, flagging the registrar for abuse escalation, and raising user awareness. Remaining risk persists due to the domain’s recent creation, low detection rate, and credible SSL issuance, indicating opportunistic deployment. Organizations should inspect internal DNS logs for recent resolutions to 188.114.96.3 and scan endpoints for outbound connections to kraken23at.net as part of post-exposure triage.