krakenhelpnow[.]readthedocs[.]io

The domain krakenhelpnow.readthedocs.io has been identified as a brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic legitimate Kraken customer support infrastructure, presenting itself as a 24/7 live help resource under the page title 'Kraken Wallet Support || 24/7 Live Customer Help — Kraken Wallet 1.0 documentation.' This aligns with tactics used to deceive users seeking assistance, potentially leading to credential theft or unauthorized access to accounts. Infrastructure analysis reveals the domain was hosted behind Cloudflare, resolving to the IP address 104.16.254.120. It was flagged by 6 of 95 security vendors on VirusTotal, indicating moderate detection but sufficient concern for blocking. The domain appears on two security blocklists, including PhishDestroy and OISD, and was registered through Cloudflare, Inc. Technologies detected include Amazon Web Services, HSTS, Cloudflare, and HTTP/3, suggesting an attempt to appear legitimate through modern web standards. The SSL certificate was issued by Google Trust Services, further obscuring its malicious intent. As of the latest verification, krakenhelpnow.readthedocs.io has been taken offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant for similar impersonation attempts. It is recommended to block the domain and associated IP at the network level, monitor for recurring threats under the same infrastructure, and educate users on verifying official support channels. Cryptocurrency platforms should proactively monitor for brand abuse and issue warnings to their user base regarding fraudulent support pages.