krak111[.]com

The domain krak111.com has been identified as a high-risk brand impersonation threat targeting the Kraken cryptocurrency exchange. This domain is actively hosting a fraudulent login page designed to trick users into revealing their credentials. The page title 'kraken' is a clear attempt to mimic the legitimate platform. No specific drainer kit has been detected, but the site's deceptive nature poses significant risks to unsuspecting visitors.

Technical analysis reveals that krak111.com is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 45.61.137.254. The domain was created on May 28, 2026, and is currently flagged by 1 security blocklist. VirusTotal data shows that 1 out of 95 security vendors have marked this domain as malicious. The SSL certificate is issued by Let's Encrypt with identifier YE2, which is commonly abused by phishing sites. Notably, the domain does not appear on Google Safe Browsing (GSB) lists, indicating a gap in coverage.

As of now, the site remains active and continues to pose a threat to Kraken users. PhishDestroy recommends immediate action: users should avoid accessing the domain and report it to relevant authorities. For those who have already interacted with the site, it is crucial to change passwords and enable two-factor authentication on their Kraken accounts. The risk level remains high due to the domain's active status and its potential to collect sensitive information. Ongoing monitoring is advised to detect any changes in its infrastructure or threat profile.