kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7instaad[.]com

This domain, kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7instaad.com, is flagged as a high-risk brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain is designed to deceive users into believing they are interacting with legitimate Kraken infrastructure, likely for credential harvesting or cryptocurrency theft. The page title "Index of /" suggests an exposed directory listing, which may indicate misconfigured or intentionally exposed phishing resources, though no drainer kit signatures have been confirmed at this time. Infrastructure analysis reveals the domain was registered on December 23, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 185.208.156.66, hosted on AS42624 (Global-Data System IT Corporation) in Switzerland. The domain is currently detected by 10 out of 95 security vendors on VirusTotal and appears on three security blocklists. No SSL certificate is present, increasing the likelihood of interception or tampering. The domain is explicitly blocked by PhishDestroy, MetaMask, and SEAL, further validating its malicious classification. As of the latest assessment, the domain remains active and continues to resolve to the identified IP address. No takedown actions have been observed, and the infrastructure persists in a state conducive to ongoing phishing operations. Users and organizations are advised to block the domain and associated IP at the network level, monitor for related subdomains or redirects, and educate stakeholders on recognizing brand impersonation tactics. The absence of SSL encryption and the domain's recent creation date underscore the need for heightened vigilance in cryptocurrency-related transactions.