kraken-krab6[.]sbs

This domain is flagged as a high-risk brand impersonation threat targeting Kraken, a major cryptocurrency exchange platform. Analysis indicates the infrastructure is designed to deceive users into submitting sensitive credentials, including login details and private keys, under the guise of legitimate Kraken services. The page title, 'Kraken krab2 - AT портал ночных развлечений,' suggests an attempt to obfuscate malicious intent through unrelated or localized content, a common tactic in phishing campaigns. Infrastructure analysis reveals the domain kraken-krab6.sbs was registered on December 25, 2025, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 186.2.175.37 and is currently offline, though prior activity remains a concern. The domain is detected by 13 out of 95 security vendors on VirusTotal, and it appears on three independent security blocklists, indicating broad consensus on its malicious nature. The SSL certificate, issued by Let's Encrypt (R13), provides encryption but does not validate legitimacy, as phishing sites commonly use free certificates to appear secure. Mitigation against this threat requires immediate action from both users and security teams. Users who may have interacted with kraken-krab6.sbs should rotate all Kraken-related credentials, enable multi-factor authentication, and monitor accounts for unauthorized transactions. Security teams should block the domain and its resolving IP (186.2.175.37) at the network perimeter, update endpoint protection rules to detect similar impersonation patterns, and alert users to verify domain authenticity before entering credentials. Given the high-risk nature of cryptocurrency-related phishing, organizations should also conduct retrospective log analysis to identify any prior exposure to this domain or associated infrastructure.