krab1[.]app

This domain is flagged for elevated-risk brand impersonation targeting Kraken, a major cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into entering credentials or financial details under the pretense of legitimate Kraken services, as evidenced by the page title 'KRAKEN' and the domain’s visual mimicry of the official exchange interface.

Infrastructure analysis reveals the domain was registered on December 04, 2025, through NiceNIC International Group Co., Limited. It resolves to IP address 172.67.201.59 and employs Cloudflare technologies, including HTTP/3, for hosting. The SSL certificate is issued by Google Trust Services. Detection metrics show 1/95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The Gridinsoft trust score for this domain is 0/100, further confirming its high-risk classification. The domain is currently offline, but its infrastructure remains a potential vector for future malicious activity.

Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP (172.67.201.59) across all network security controls. Organizations should monitor for credential theft attempts targeting Kraken users, particularly those who may have interacted with the domain prior to its takedown. Security teams are advised to review logs for connections to the domain or IP and conduct user awareness training to highlight the risks of brand impersonation in cryptocurrency-related phishing. Additionally, domain registration monitoring should be implemented to detect similar impersonation attempts using slight variations of the Kraken brand name.