krakenmarketplaces[.]cc

krakenmarketplaces.cc is an actively malicious domain engaged in brand impersonation targeting the cryptocurrency exchange Kraken. This threat is classified as elevated due to the risk of credential theft and financial fraud through deceptive replication of Kraken’s legitimate platform. The domain leverages a visually similar interface to trick users into surrendering sensitive account information or transferring funds under false pretenses. Security researchers and users should treat this domain with extreme caution and avoid any interaction that could expose personal or financial data.

This domain was flagged by PhishDestroy and appears on 1 security blocklist, with 7 out of 95 VirusTotal security vendors detecting malicious activity. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 172.67.171.46. The domain was created on June 27, 2025, and holds an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. Despite the presence of a valid SSL certificate, the domain’s malicious intent is clear given the combination of recent creation, impersonation tactics, and detection by multiple security vendors. The registrar and hosting infrastructure may facilitate rapid domain turnover, a common tactic among threat actors to evade long-term blocklisting or takedown efforts.

To mitigate the threat posed by krakenmarketplaces.cc, users should immediately refrain from accessing the domain or any associated URLs. Organizations are advised to block the domain and IP address 172.67.171.46 at the network perimeter using firewall rules or DNS sinkholing. Kraken users should be notified to verify the legitimacy of any communication purporting to originate from the exchange, and to only access Kraken services via verified domains (e.g., kraken.com) or through official mobile applications. Additionally, security teams should monitor for related domains registered around the same timeframe or using similar naming conventions, as threat actors often deploy clusters of impersonation domains to maximize reach and persistence. Reporting this domain to PhishDestroy and other threat intelligence platforms will aid in broader mitigation efforts and help protect other potential victims from falling prey to this brand impersonation scheme.