# kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad.net — MALICIOUS

> PhishDestroy identifies a live Kraken phishing domain (kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad.net) hosting a wallet drainer kit.

## Summary
PhishDestroy identifies a brand impersonation domain leveraging Kraken’s identity to deploy a wallet drainer kit. The domain kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad.net mimics the legitimate Kraken cryptocurrency exchange, tricking users into entering credentials or connecting wallets.  This domain was flagged by 18/95 security vendors on VirusTotal, indicating elevated risk. It resolves to IP 104.21.52.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on October 23, 2023. The domain holds a Google Trust Services SSL certificate, adding false legitimacy. With 18 detections and a recent creation date, this threat remains active and poses a significant risk to cryptocurrency users.  The domain is currently active, and immediate blocklisting is advised due to its ongoing phishing operations. Users should avoid interacting with this domain and report any exposure. Remaining risk is elevated given the drainer kit’s active deployment and the domain’s recent registration.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Kraken

## Domain Intelligence
- Registered: 2023-10-23 21:47:25
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.52.3

## Detection Status
- VirusTotal: 18 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/ba137d7c-01ec-498b-bb44-8b96a974d84d
- PhishDestroy: https://phishdestroy.io/domain/kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad.net/
- LLM endpoint: https://phishdestroy.io/domain/kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad.net/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/kraken5af44k24fwzohe6fvqfgxfsee4lgydb3ayzkfhlzqhuwlo33ad.net/
Last updated: 2026-03-27