krakenter[.]cc

The domain krakenter.cc has been confirmed as a phishing site specializing in brand impersonation targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the site presents a fraudulent login interface, specifically titled "Кракен вход — безопасно, без VPN и с Telegram," designed to harvest user credentials under the guise of secure access. The domain is currently offline, though prior activity suggests it was actively used to deceive users into divulging sensitive account information. Infrastructure analysis reveals the domain was registered on July 24, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Detection metrics show the domain is flagged by 15 of 95 security vendors on VirusTotal, with one additional security blocklist (PhishDestroy) listing it as malicious. The SSL certificate is issued by Let's Encrypt (serial number E7), a common tactic among phishing sites to mimic legitimacy. No historical DNS records or subdomains were observed, suggesting a short-lived, targeted campaign. Given the elevated risk level and confirmed brand impersonation tactics, organizations and individuals are advised to block the domain and associated IP at the network level. Users who may have interacted with the site should immediately reset their Kraken account credentials and enable multi-factor authentication. Security teams should monitor for credential reuse across other platforms, as harvested data may be leveraged in secondary attacks. Proactive scanning for related domains registered through the same registrar or resolving to the identified IP range is recommended to identify potential campaign expansion.