kraken7jmgt7yhhe2c4iyilthnhcugfylcztsdhh7otrr6jgdw667pqd-onion[.]org

This domain, kraken7jmgt7yhhe2c4iyilthnhcugfylcztsdhh7otrr6jgdw667pqd-onion.org, poses a significant brand impersonation threat targeting the Kraken cryptocurrency exchange. The domain was created to deceive users into believing they are accessing a legitimate Kraken service, potentially leading to the theft of sensitive information such as login credentials and personal data.

Analysis indicates that the domain was created on December 09, 2023, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IP address 89.124.90.206, which is located in the Netherlands and hosted by Servers Tech Fzco. Currently, the domain appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt, which is a common practice among phishing sites to gain user trust. The page title 'Google' is an anomaly, suggesting that the threat actors may have used this title to avoid detection or to redirect users to a more convincing phishing page.

If users have visited this domain, they are advised to immediately change their Kraken account passwords and enable two-factor authentication (2FA) if not already active. Users should also monitor their accounts for any unauthorized transactions and report any suspicious activity to Kraken's customer support. Additionally, it is recommended to run a full system scan using updated antivirus software to ensure that no malware was installed during the visit. Users are encouraged to only access Kraken through official and verified channels to avoid falling victim to similar threats in the future.