kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7insta[.]com

This domain, kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7insta.com, is flagged as a high-risk brand impersonation targeting Kraken, a cryptocurrency exchange. Registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains active as of July 12, 2026. It resolves to IP address 188.114.97.3 and uses Cloudflare infrastructure, including Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Google Trust Services, a common but not inherently malicious provider. Analysis indicates the domain is designed to mimic the Kraken brand, as evidenced by the page title 'KRAKEN' and its inclusion in 22 threat intelligence pulses on AlienVault OTX. It appears on two security blocklists and is blocked by PhishDestroy and BLP-Malware. Four of 95 security vendors on VirusTotal flag the domain, though this does not confirm malicious activity on its own. The Gridinsoft trust score of 0/100 further suggests high risk. Defenders should treat this domain as a confirmed impersonation threat. Immediate actions include blocking the domain and its resolving IP at network and endpoint levels, updating detection rules to include the domain and associated indicators, and monitoring for user interactions or credential submissions tied to this infrastructure. The use of Cloudflare may complicate takedown efforts, so coordination with the hosting provider and certificate authority may be necessary. No evidence of a specific phishing kit or payload is currently available, but the domain’s active status and brand alignment warrant proactive mitigation.