krakem[.]at

This domain is flagged as an active brand impersonation targeting Kraken, a cryptocurrency platform. The page title, written in Russian, translates to 'Kraken Official Site: Safe Login and Marketplace Mirrors,' which is consistent with a phishing page designed to harvest credentials or direct users to fraudulent mirrors. The domain resolves to IP 82.25.102.230, hosted in Germany by Hostinger International Limited (AS47583), and uses Cloudflare nameservers (carl.ns.cloudflare.com, luciana.ns.cloudflare.com). Its SSL certificate is issued by Let's Encrypt (R12), a common choice for low-cost or rapid deployment of phishing sites. The domain has an MX record pointing to itself, suggesting it may also handle email, potentially for credential harvesting or spam campaigns. VirusTotal reports 1 detection out of 95 vendors, indicating limited but confirmed malicious recognition, and it appears on one security blocklist (PhishDestroy). The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of high risk. The domain remains active and accessible, with an HTTP 200 status. Defenders should block this domain at the network and email gateway levels, monitor for related subdomains or IP changes under the same ASN, and review any user accounts that may have interacted with the site. Given the low detection rate on VirusTotal, additional sandbox analysis or manual inspection of the page content is recommended to confirm the exact phishing mechanism and update threat intelligence feeds accordingly.