kraken27[.]shop

This domain, kraken27.shop, is flagged as an active phishing site targeting users of the Kraken cryptocurrency exchange. Analysis indicates the domain was registered on August 1, 2025, through Dynadot LLC and remains operational as of July 12, 2026. The page title explicitly displays 'KRAKEN,' aligning with the confirmed brand impersonation of the legitimate exchange. Infrastructure analysis reveals the domain resolves to IP address 172.67.148.48, with detected technologies including Cloudflare, Cloudflare Browser Insights, and HTTP/3. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious sites leveraging CDN services. Threat intelligence aggregators provide additional context for this domain. AlienVault OTX lists kraken27.shop in 23 separate threat intelligence pulses, suggesting repeated identification in phishing campaigns. VirusTotal reports that 5 out of 95 security vendors have flagged the domain, while Gridinsoft assigns it a trust score of 0/100. The domain appears on two security blocklists and is actively blocked by at least two security providers, further corroborating its malicious status. The combination of brand impersonation, recent registration, and detection by multiple security sources supports the classification of this domain as high-risk. While the exact content of the site has not been analyzed, the available evidence strongly indicates an intent to deceive users into disclosing credentials or sensitive information. Defenders should prioritize blocking the domain at the DNS or network level, as well as monitoring for related indicators of compromise, such as the associated IP address. The use of Cloudflare infrastructure may complicate takedown efforts, but reporting the domain to the registrar (Dynadot LLC) and relevant abuse channels is recommended. Given the domain's persistence since its creation in 2025, continued vigilance is warranted to mitigate potential user exposure.