krakenclickwyskd[.]com

Analysis of krakenclickwyskd.com indicates that the domain was registered through GMO Internet, Inc. on February 21, 2026 and subsequently taken offline. The site presented a page title of "Kraken," directly impersonating the Kraken brand, and is classified as a crypto‑related scam. Infrastructure examination shows the domain resolves to IP address 104.21.14.70, which belongs to AS13335 operated by Cloudflare, Inc., and is located in the United States. Nameserver configuration uses candy.ns.cloudflare.com and javon.ns.cloudflare.com, confirming reliance on Cloudflare’s DNS services.

No SSL certificate was observed, meaning the site served content over plain HTTP, a typical characteristic of low‑cost malicious deployments. VirusTotal scans recorded 12 detections out of 93 security vendors, reinforcing the malicious nature of the domain. Google Safe Browsing flagged the site for social engineering, and three independent blocklists—PhishDestroy, MetaMask, and SEAL—have listed the domain as hostile. The domain appears on three additional security blocklists, further corroborating its reputation as a threat.

While the exact phishing page content has not been captured, the combination of brand impersonation, crypto scam labeling, and the observed detection metrics provide sufficient confidence to treat the domain as a confirmed malicious actor. Defenders should update web filtering and DNS sinkhole rules to block both the domain and its resolved IP address, monitor for any residual traffic to the Cloudflare IP range associated with this host, and enforce strict email and web gateway policies to prevent users from accessing the site. Continuous threat‑intel feeds should be consulted for any re‑use of the same registrar or nameserver patterns, as adversaries often recycle these components in future campaigns.