kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad[.]org

PhishDestroy identifies active brand impersonation threat involving domain kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad.org. This domain is engaged in credential theft activities, specifically impersonating the cryptocurrency exchange Kraken. The threat is currently active and poses elevated risk to unsuspecting users. This domain was flagged by 15 of 95 VirusTotal vendors, indicating significant malicious activity. The domain resolves to IP address 104.21.36.108 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on October 23, 2023. The SSL certificate is issued by Google Trust Services, which may contribute to a false sense of security for potential victims. Current status of this domain is active, with elevated risk due to its impersonation of a well-known cryptocurrency brand. Immediate action is recommended: block the domain at network and DNS levels, flag the associated IP address, and alert users to avoid interacting with this domain. Additionally, organizations should update their threat intelligence feeds and security protocols to include this domain and its indicators of compromise.