kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumw7instad[.]com

The domain kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumw7instad.com was identified as a brand impersonation threat specifically targeting Kraken, the popular cryptocurrency exchange. This domain is currently offline, having been taken down after its malicious activity was detected. It was created on March 27, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for being used by threat actors. The domain resolved to IP address 172.67.136.208 and had an SSL certificate issued by Google Trust Services under the WE1 certificate authority. Its page title was simply "KRAKEN," designed to deceive visitors into believing they were accessing the legitimate Kraken platform.

This domain appeared on one security blocklist and was flagged by 7 out of 95 VirusTotal vendors, indicating a moderate but notable detection rate. Additionally, it was found in one threat intelligence pulse on AlienVault OTX, showing that security researchers had already linked it to malicious activity. Despite being offline, the domain's infrastructure and registration details provide valuable indicators for future threat hunting. The use of a brand impersonation tactic with a high-risk target like Kraken underscores the persistent threat of phishing domains in the cryptocurrency space.

Given that the domain is now offline, the immediate risk is diminished, but users should remain cautious of similar domains that may appear. PhishDestroy recommends that Kraken users always verify the URL before entering credentials or connecting wallets, enable two-factor authentication, and report any suspicious domains to Kraken's security team. Monitoring for subdomains or variations of this domain is also advised, as threat actors often recycle infrastructure. Organizations should add the domain's indicators to their blocklists and educate users about brand impersonation techniques used in crypto phishing campaigns.