# kraken6at.net — MALICIOUS

> kraken6at.net is a crypto drainer impersonating Kraken crypto exchange. Security vendors flagged 5/95, verify safety on PhishDestroy.

## Summary
PhishDestroy identifies kraken6at.net as a crypto drainer domain impersonating the legitimate Kraken cryptocurrency exchange platform. This fraudulent site employs branding mimicry to deceive users into connecting cryptocurrency wallets under the false pretense of offering exchange services or promotions. The domain specifically targets users familiar with Kraken's services, exploiting trust in the brand to facilitate unauthorized cryptocurrency transfers through wallet-draining mechanisms. Security researchers have documented active campaigns where threat actors distribute links to this domain via phishing emails, social media messages, or fraudulent advertisements, typically promising exclusive offers or account verification processes to lure victims into connecting their wallets. Once connected, the site initiates unauthorized transactions that drain digital assets without user consent.  This domain was flagged by 5 out of 95 leading security vendors on VirusTotal, indicating partial detection coverage but not universal recognition as malicious. The domain kraken6at.net was registered on April 4, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk domain registrations. The site operates using an SSL certificate issued by Google Trust Services, likely to appear legitimate and evade browser security warnings. It resolves to the IP address 188.114.97.3, which has been associated with previous cryptocurrency-related fraud campaigns. The relatively recent creation date and low detection rate suggest this is a newly deployed threat actor infrastructure designed to evade early-stage detection systems.  Users who have visited kraken6at.net or entered any information should immediately disconnect their cryptocurrency wallets and revoke any connected permissions through their wallet provider's interface. Monitor blockchain transactions for unauthorized transfers and report any fraudulent activity to the respective wallet provider and cryptocurrency exchange. PhishDestroy recommends scanning all devices used for cryptocurrency transactions with updated antivirus software to detect potential malware that may have been installed during the visit. Report this domain to PhishDestroy's database to enhance collective threat intelligence and prevent further victimization. Users should always verify the legitimacy of cryptocurrency-related websites by checking official Kraken domains (kraken.com) and enabling two-factor authentication on all exchange accounts.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Kraken

## Domain Intelligence
- Registered: 2025-04-04 15:22:48
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 5 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/39d04520-ac9a-4d7c-ad01-9e57959a05ba
- PhishDestroy: https://phishdestroy.io/domain/kraken6at.net/
- LLM endpoint: https://phishdestroy.io/domain/kraken6at.net/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/kraken6at.net/
Last updated: 2026-03-28