firewall-kraken[.]com

The domain firewall-kraken.com is a cryptocurrency phishing site engaged in brand impersonation targeting Kraken, a well-known cryptocurrency exchange. It was designed to deceive users into believing they were interacting with the legitimate Kraken platform, likely to steal login credentials or other sensitive information. As of the latest verification, firewall-kraken.com has been taken offline, but it remains under investigation for its prior malicious activity.

Technical analysis of firewall-kraken.com reveals minimal detection at the time of assessment, with 0 of 95 VirusTotal vendors flagging the domain. The domain was registered through Porkbun LLC on November 05, 2025, and resolved to the IP address 34.223.35.249, hosted on Amazon Web Services in the US. It appears on a single security blocklist, PhishDestroy, and uses an SSL certificate issued by Let's Encrypt (R13). The observed page title was 'A Brand New Domain!', and the site employed technologies including PHP, Bootstrap, Nginx, and Amazon S3. MX records point to Porkbun's forwarding servers, and the domain's nameservers are also managed by Porkbun.

Users who may have interacted with firewall-kraken.com should immediately change their Kraken account passwords and enable two-factor authentication if not already active. Monitor account activity for unauthorized transactions or login attempts. Victims should also report the phishing domain to Kraken's official support channels and consider submitting the domain to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.