krakenexchange[.]site

Analysis of krakenexchange.site, observed on 25 July 2026, shows an active cryptocurrency‑related impersonation campaign targeting the Kraken brand. The domain was registered on 19 November 2025 through GMO Internet, Inc., and resolves to the IPv6 address 2a01:7e01::f03c:95ff:fe91:5d91, which is assigned to AS63949 (Akamai Connected Cloud) in Germany. HTTP requests return a 200 status and the server reports PHP as the underlying technology. The site presents a TLS certificate from Let’s Encrypt (R13), indicating a valid but freely issued certificate.

DNS resolution is delegated to hehua.ns.giantpanda.com and qizai.ns.giantpanda.com. Reputation data shows the domain appears on a single security blocklist and is listed as blocked by PhishDestroy. On VirusTotal, ten of ninety‑five scanning engines flag the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The page title returned by the server is “krakenexchange.site”, matching the domain name and providing no additional context.

The campaign is classified as a crypto scam, and the brand target is explicitly identified as Kraken. No further content analysis is available, leaving the exact user‑facing payload unknown. Defenders should add the IPv6 address and domain to blocklists, monitor DNS queries for the listed nameservers, and enforce strict outbound filtering for Let’s Encrypt‑issued certificates associated with this ASN. Continuous monitoring of threat intelligence feeds for additional indicators, such as URL patterns or payload hashes, is recommended to capture any evolution of the campaign.