kraken103[.]at

Analysis of kraken103.at shows an elevated‑risk, brand‑impersonation campaign targeting Kraken users. The domain was registered on March 06, 2026 and currently resolves to 104.21.66.159, an address owned by Cloudflare (AS13335) located in the United States. HTTP requests return a 403 status, indicating that the site is presently taken offline, and the page title reported by scanners is simply "kraken103.at". Technical fingerprints identify Cloudflare services and HTTP/3 support, while the TLS certificate is issued by Google Trust Services under the WE1 profile, confirming a legitimate certificate chain but not the legitimacy of the content.

Reputation checks reveal a Gridinsoft trust score of 0 / 100 and placement on a single security blocklist. Six of ninety‑four VirusTotal scanners flag the domain as malicious, and PhishDestroy has already blocked it. The registrar information points to Docky / Huang Chao Ming via the Austrian NIC (registrar ID 723), and the authoritative nameservers are gwen.ns.cloudflare.com and terry.ns.cloudflare.com. The listed scam type is a crypto scam, and the domain explicitly impersonates the Kraken brand.

No additional content has been captured, so the exact phishing payload or credential‑harvesting mechanisms remain unknown. Defenders should immediately block the domain and its resolving IP at perimeter and endpoint controls, monitor for other Cloudflare‑hosted domains using the same nameservers, and consider adding the domain to internal threat intelligence feeds. Continuous re‑scanning is advised to detect any changes in status or new detections from additional security vendors.