# krakenmarketplaces.cc — MALICIOUS

> The domain krakenmarketplaces.cc is a high-risk Kraken impersonation phishing site. 7 of 95 VirusTotal vendors flagged it for brand abuse.

## Summary
krakenmarketplaces.cc is an actively malicious domain engaged in brand impersonation targeting the cryptocurrency exchange Kraken. This threat is classified as elevated due to the risk of credential theft and financial fraud through deceptive replication of Kraken’s legitimate platform. The domain leverages a visually similar interface to trick users into surrendering sensitive account information or transferring funds under false pretenses. Security researchers and users should treat this domain with extreme caution and avoid any interaction that could expose personal or financial data.


This domain was flagged by PhishDestroy and appears on 1 security blocklist, with 7 out of 95 VirusTotal security vendors detecting malicious activity. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 172.67.171.46. The domain was created on June 27, 2025, and holds an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. Despite the presence of a valid SSL certificate, the domain’s malicious intent is clear given the combination of recent creation, impersonation tactics, and detection by multiple security vendors. The registrar and hosting infrastructure may facilitate rapid domain turnover, a common tactic among threat actors to evade long-term blocklisting or takedown efforts.


To mitigate the threat posed by krakenmarketplaces.cc, users should immediately refrain from accessing the domain or any associated URLs. Organizations are advised to block the domain and IP address 172.67.171.46 at the network perimeter using firewall rules or DNS sinkholing. Kraken users should be notified to verify the legitimacy of any communication purporting to originate from the exchange, and to only access Kraken services via verified domains (e.g., kraken.com) or through official mobile applications. Additionally, security teams should monitor for related domains registered around the same timeframe or using similar naming conventions, as threat actors often deploy clusters of impersonation domains to maximize reach and persistence. Reporting this domain to PhishDestroy and other threat intelligence platforms will aid in broader mitigation efforts and help protect other potential victims from falling prey to this brand impersonation scheme.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Kraken

## Domain Intelligence
- Registered: 2025-06-27 16:18:10
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.171.46

## Detection Status
- VirusTotal: 7 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/6ba1d2b4-fe5f-4bd7-ae56-89794389c097
- PhishDestroy: https://phishdestroy.io/domain/krakenmarketplaces.cc/
- LLM endpoint: https://phishdestroy.io/domain/krakenmarketplaces.cc/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/krakenmarketplaces.cc/
Last updated: 2026-03-26