kraken12[.]co[.]at

Analysis of kraken12.co.at, observed on July 25, 2026, indicates that the domain is being used for a cryptocurrency‑related brand impersonation campaign targeting Kraken users. The site lacks an SSL certificate, which results in unencrypted HTTP traffic and is a common indicator of low‑quality malicious infrastructure. Gridinsoft’s trust scoring system assigns the domain a score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal scans show that six of ninety‑three security vendors flagged the domain as malicious, providing independent confirmation of its suspicious nature. The domain resolves to IP address 104.21.35.42, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States; the use of Cloudflare’s network is consistent with many abuse‑hosting operations that leverage shared infrastructure to hide true origins. Nameserver records point to luke.ns.cloudflare.com and rosalie.ns.cloudflare.com, further confirming reliance on Cloudflare’s DNS services.

Registration data ties the domain to the NETIM registrar (nic.at/registrar/586), a known registrar for Austrian second‑level domains. The domain is currently taken offline, but historical evidence shows it was previously listed on at least one security blocklist and actively blocked by PhishDestroy, indicating that defensive feeds have recognized the threat. The page title retrieved from the site reads "KRA46 AT, KRA46 CC, KRA47 AT, KRA47 CC, KRAB1 AT, KRAB1 CC - любой клад, секрет", which does not reference Kraken directly but reinforces the presence of a Russian‑language landing page often associated with crypto scams.

The combination of brand impersonation (Kraken), the crypto scam classification, low trust scores, lack of TLS, and multiple vendor detections suggest that the domain was deliberately crafted to lure victims into providing cryptocurrency credentials or payments.