2fa-kraken[.]com

The domain 2fa-kraken.com is identified as a high-risk brand impersonation threat targeting the cryptocurrency exchange Kraken. Analysis indicates the domain was designed to mimic legitimate two-factor authentication (2FA) verification processes, likely to harvest user credentials or facilitate unauthorized account access. As of the latest assessment, the domain has been taken down, though residual risks may persist through cached or redirected infrastructure. Infrastructure analysis reveals the domain was registered on September 29, 2025, through OwnRegistrar, Inc., a registrar frequently associated with malicious domains. It resolved to the IP address 198.23.156.130, hosted on AS36352 (HostPapa) in the United States, with no SSL certificate deployed. Detection metrics show the domain was flagged by 14 of 95 security vendors on VirusTotal, while Google Safe Browsing and PhishDestroy independently classified it as phishing. The domain appeared on at least one security blocklist, and its page title, 'Account Suspended,' suggests an attempt to create urgency or panic among targeted users. Current status confirms the domain has been disabled, though threat actors may attempt to re-establish operations under similar or newly registered domains. Users are advised to verify all communications claiming to originate from Kraken by accessing the platform exclusively through official channels. Organizations should monitor for domains leveraging similar naming conventions (e.g., '2fa-' or 'verify-' prefixes) and enforce multi-factor authentication (MFA) policies to mitigate credential-based attacks. Network defenders are encouraged to block the IP address 198.23.156.130 and monitor for connections to domains registered via OwnRegistrar, Inc., particularly those created within the last 30 days.