# krakenlink-market.cc — MALICIOUS

> krakenlink-market.cc active brand impersonation site flagged by 13/95 VirusTotal engines. Do NOT connect wallet or enter credentials.

## Summary
PhishDestroy identifies krakenlink-market.cc as an active brand-impersonation domain targeting Kraken users. The site mimics the legitimate Kraken exchange to harvest credentials or deploy a crypto-draining kit against connected wallets. No specific drainer kit was observed in automated scans, but the page title exactly matches the domain name, indicating a hastily assembled landing page designed for quick credential theft and wallet draining. The absence of TLS and the presence of only a basic HTML form further suggest a low-fidelity but high-impact campaign aimed at unsuspecting users seeking “quick links” to Kraken services.  krakenlink-market.cc was first registered on March 13, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Public DNS resolves the domain to IP 86.54.25.38, a hosting range associated with multiple low-reputation domains. VirusTotal analysis reveals detection by 13 of 95 security engines as of the latest scan, placing the domain at elevated risk. Google Safe Browsing has not yet flagged the domain, and third-party blocklists currently show zero detections, indicating rapid emergence and low prior exposure. WHOIS data reveals a registrant privacy shield, obscuring true ownership and increasing operational security for the threat actor.  This domain remains active and poses an elevated threat to cryptocurrency users. Immediate containment measures include DNS sinkholing of 86.54.25.38 and domain takedown requests directed at NICENIC and upstream providers. Users are strongly advised to verify any Kraken-related links via official channels and to revoke any wallet connections made after visiting this domain. Ongoing monitoring is required, as the threat actor may rapidly shift infrastructure or refine lures. Remaining risk remains high due to the fresh registration, low blocklist coverage, and the high-value target of major cryptocurrency exchanges.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Kraken
- Page title: krakenlink-market.cc

## Domain Intelligence
- Registered: 2025-03-13 16:21:02
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 86.54.25.38

## Detection Status
- VirusTotal: 13 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/4c209b2e-d483-4679-b37a-c0f82f921158
- PhishDestroy: https://phishdestroy.io/domain/krakenlink-market.cc/
- LLM endpoint: https://phishdestroy.io/domain/krakenlink-market.cc/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/krakenlink-market.cc/
Last updated: 2026-03-28