kraken-supportchat[.]kb[.]help

Analysis of kraken-supportchat.kb.help shows a newly registered domain (creation date 2026-06-11) that is actively used for phishing. The registrar information indicates registration through Marcaria International LLC, a service often leveraged for rapid bulk domain deployment. DNS resolution points to a single IPv4 address, 3.171.214.27, hosted on Amazon Web Services infrastructure, as evidenced by the four AWS name servers (ns-1181.awsdns-19.org, ns-1794.awsdns-32.co.uk, ns-607.awsdns-11.net, and an incomplete fourth entry).

The domain appears on three public security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat intelligence feeds have identified malicious activity associated with this host. VirusTotal scans reported six positive detections out of ninety‑one antivirus engines, further reinforcing the malicious classification. No additional indicators such as SSL certificates, HTTP response codes, or page titles have been disclosed, leaving the surface‑level content of the site unverified.

Given the convergence of registrar abuse, rapid provisioning, blocklist inclusion, and multi‑engine detections, the domain should be treated as a confirmed phishing source. Defenders are advised to add the domain and its resolving IP address to local deny lists, monitor for any related sub‑domains or similar naming patterns, and ensure that email gateways and web filters reference the blocklists that already flag this host. Continuous re‑evaluation is recommended to capture any new infrastructure changes or additional detections that may arise.