krakenload[.]app

The domain krakenload.app is identified as a brand impersonation threat targeting Kraken, a well-known cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users by presenting itself as an "API Load Testing Tool," a guise likely intended to harvest credentials or distribute malicious payloads under the pretense of legitimate functionality. The domain is currently offline, but its infrastructure and historical activity warrant further scrutiny. Infrastructure analysis reveals the domain was registered on December 15, 2025, through Spaceship, Inc., and resolved to the IP address 89.149.243.249, hosted on AS60781 (LeaseWeb Netherlands B.V.). Security vendors flagged krakenload.app in 9 out of 95 VirusTotal scans, and it appears on at least one security blocklist. The SSL certificate was issued by Let’s Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its accessibility. The page title, "API Load Testing Tool," aligns with tactics used to lure technical users into interacting with fraudulent services. Current status confirms the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future malicious activity. Organizations and individuals are advised to monitor for re-emergence of this domain or similar variants, particularly those leveraging cryptocurrency branding. Network defenders should block the IP address 89.149.243.249 and domain krakenload.app at perimeter defenses, while users should verify the authenticity of any API-related tools through official Kraken channels. Historical indicators, including the domain’s creation date and registrar details, should be incorporated into threat intelligence feeds for proactive detection.