zerkalokraken[.]com

Analysis of zerkalokraken.com indicates an active brand‑impersonation campaign targeting Kraken. The domain was registered on 20 April 2026 through CloudNineDomain, LLC and resolves to the AWS Global Accelerator address 13.248.169.48 located in Canada. HTTP requests return a 200 status, and the site presents a GoDaddy‑issued DV TLS certificate chained to the GoDaddy TLS Intermediate CA DV – R1v1. Reputation data show the domain appears on a single security blocklist and is currently blocked by PhishDestroy. VirusTotal scans have resulted in 12 of 94 security vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100. AlienVault OTX references the domain in one threat‑intelligence pulse. The combination of recent registration, use of cloud infrastructure, low trust score, and multiple vendor detections suggests a high‑risk phishing operation. At present, no public content analysis is available, so the specific tactics employed on the landing page remain unknown. Defenders should block the domain at the network perimeter, add the IP address 13.248.169.48 to deny lists, and monitor for any related indicators of compromise. Continuous intelligence gathering is recommended to capture any future payloads or credential‑harvesting mechanisms that may be deployed.