web-kraken-start[.]zapier[.]app

This domain is flagged under investigation for brand impersonation targeting Kraken, a cryptocurrency exchange platform. The threat involves a fraudulent login portal designed to harvest credentials, classified specifically as brand_impersonation with an active status. Analysis indicates the domain is hosted on infrastructure associated with legitimate services, complicating detection efforts. Infrastructure analysis reveals the domain resolves to the IP address 64.239.109.1, with no prior detections on VirusTotal (0/95 engines). The page title, 'Kraken Pro Login Secure,' mimics the legitimate Kraken Pro interface to deceive users. The SSL certificate is issued by Let's Encrypt, a common certificate authority, which provides a false sense of security. The domain is registered under Zapier's app platform, leveraging its subdomain structure to evade traditional blocklist mechanisms. No creation date is publicly available, and the domain remains unlisted on major threat intelligence blocklists at the time of analysis. Mitigation steps for this threat type include immediate reporting to the hosting provider (Zapier) for takedown, as the domain abuses their subdomain service. Organizations should update web filtering rules to block the domain and its resolving IP (64.239.109.1) at the network perimeter. End-users should be educated to verify domain authenticity before entering credentials, particularly for financial or cryptocurrency platforms. Security teams are advised to monitor for similar subdomain abuse patterns under trusted service providers, as these tactics are increasingly used to bypass detection.