kraken014-at[.]com

This domain, kraken014-at.com, poses a direct threat to users of the Kraken cryptocurrency exchange by impersonating its official login interface. Analysis indicates the site was designed to harvest credentials, potentially leading to unauthorized access to user accounts and financial theft. The presence of a deceptive 'Captcha' page title suggests an attempt to mimic legitimate security verification steps, increasing the likelihood of user deception during the phishing process.

Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The site resolved to IP address 172.67.175.15, hosted on Cloudflare infrastructure in Canada, which is commonly exploited to obscure malicious activity. At the time of detection, 10 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), further aligns with patterns observed in phishing campaigns leveraging trusted certificate authorities to enhance legitimacy.

If you visited kraken014-at.com or entered any credentials, immediate action is required. First, revoke access to any active sessions on the legitimate Kraken platform and enable multi-factor authentication if not already active. Second, monitor all linked accounts, including email and cryptocurrency wallets, for unauthorized transactions or login attempts. Third, consider rotating passwords for all critical accounts, prioritizing those sharing credentials with the compromised site. Report the incident to Kraken’s official security team and relevant authorities to assist in tracking the infrastructure and preventing further abuse.