n8n[.]krakensys[.]xyz

This domain, n8n.krakensys.xyz, was registered on May 15, 2026, and is actively impersonating the Kraken brand, as indicated by its classification as a brand impersonation scam. The domain resolves to IP 213.199.63.79, hosted by Contabo GmbH in France, with nameservers ns1.contabo.net, ns2.contabo.net, and ns3.contabo.net. It is currently active, returning an HTTP 200 status, and presents a page title suggesting workflow automation ([krakensys.xyz] n8n.io - Workflow Automation), though the exact content and functionality remain unconfirmed. The domain appears on three security blocklists and is flagged by 11 of 92 security vendors on VirusTotal, indicating broad detection. The SSL certificate is issued by Let's Encrypt (R12), and the domain was registered through Vautron Rechenzentrum AG. Defenders should treat this domain as high-risk due to its confirmed brand impersonation, active status, and presence on multiple blocklists. Immediate blocking at the DNS or network level is recommended, along with monitoring for related infrastructure or domains registered under the same nameservers or IP range. Further analysis of the site's behavior, such as credential harvesting or malware distribution, is advised if user interaction is suspected.