# PhishDestroy domain threat record: krakenpipeline.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/krakenpipeline.com/ Machine-readable companion: https://phishdestroy.io/domain/krakenpipeline.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 07:48:12 UTC - Last availability or vendor check: 2026-10-22 10:29:27 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 6/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Kraken ## Stored infrastructure - Observed IP address: 134.209.26.210 - Registrar in stored WHOIS data: DonDominio (SCIP) - Registrar country in stored WHOIS data: ES - Last stored HTTP status: 200 - Registration date (registry RDAP, krakenpipeline.com): 2024-10-28 09:24:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a056c8-71e1-73ca-a7a5-1dc03a43faae/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/krakenpipeline.com - Certificate Transparency search: https://crt.sh/?q=%25.krakenpipeline.com - Web Archive lookup: https://web.archive.org/web/*/https://krakenpipeline.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview krakenpipeline.com is a phishing site that borrows the Kraken exchange brand and presents itself under the page title 'Kraken Pipeline'. It targets Kraken customers and crypto holders who expect a genuine Kraken service. PhishDestroy first flagged it on 2026-08-31, and the page was still online with live content when last checked on 2026-10-19. How the scam works The 'Kraken Pipeline' name dresses the site up as an official Kraken product or programme, which gives visitors a reason to trust it and act quickly. Impersonation pages like this usually ask victims to sign in with their exchange credentials and 2FA codes, connect a wallet, or send funds to unlock a promised feature. Anything entered goes straight to the operators. Stolen logins let them empty exchange balances, and wallet connections or deposits move crypto out of the victim's control for good. Evidence Detection coverage is thin. VirusTotal shows 6 of 89 engines flagging the domain as of 2026-09-12: alphaMountain.ai, Chong Lua Dao, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. Most scanners still treat the site as clean, so a lack of browser warnings means little here. Wallet-focused defences have caught it, though. MetaMask and SEAL list the domain alongside PhishDestroy, and it appears in 4 AlienVault OTX threat pulses. Infrastructure The domain was registered on 2024-10-28 through DonDominio (SCIP), almost two years before PhishDestroy detected it. That gap suggests a domain held in reserve or reused rather than one spun up for a single campaign. The site runs on DigitalOcean cloud hosting in the United Kingdom. Its Let's Encrypt certificate gives it the usual browser padlock, which proves nothing about who runs the site. What to do If you entered Kraken credentials here, change your Kraken password at once, reset 2FA, review active sessions and API keys, and check your withdrawal address whitelist. If you connected a wallet or signed anything, revoke token approvals with a trusted approval checker and move remaining assets to a fresh wallet if you signed a suspicious message. If you sent funds, contact Kraken support and report the theft to authorities with the transaction details. Kraken does not offer a 'Pipeline' service through this domain. Defenders should block krakenpipeline.com at DNS and proxy level and add it to phishing filters, because most commercial engines do not yet catch it. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a056c8-71e1-73ca-a7a5-1dc03a43faae/ VirusTotal report: https://www.virustotal.com/gui/domain/krakenpipeline.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=krakenpipeline.com Archived copy: https://web.archive.org/web/20260831075239/https://krakenpipeline.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:53:47 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a056c8-71e1-73ca-a7a5-1dc03a43faae.png Captured: 2026-08-31 07:48:12 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a056c8-71e1-73ca-a7a5-1dc03a43faae.png Captured: 2026-08-31 07:48:12 UTC Source report: https://urlscan.io/result/01a056c8-71e1-73ca-a7a5-1dc03a43faae/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:26:43Z", "uuid": "01a056c8-71e1-73ca-a7a5-1dc03a43faae", "scanned_at": "2026-08-31T07:46:22Z", "final_url": "https://krakenpipeline.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://krakenpipeline.com/", "from": "http://krakenpipeline.com/", "status": 307 } ], "ip": "134.209.26.210", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.163.94", "142.251.179.95", "134.209.26.210" ], "asns": [ "15169", "14061" ], "countries": [ "US", "GB" ], "doc_hash": "4151d049f2a592a36dd68cb5982d4ce949088062a07245436a582564e3ab479c", "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "animateViewBox", "svgElement", "viewBoxX", "viewBoxY", "viewBoxX2", "viewBoxY2", "incrementX", "incrementY" ], "tls": { "san": [ "krakenpipeline.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "krakenpipeline.com", "protocol": "TLS 1.3", "valid_to": "2026-11-18T01:33:24Z", "valid_from": "2026-08-20T01:33:25Z" }, "domain_age_days": 671, "apex_age_days": 671, "tls_age_days": 11, "tls_valid_days": 89, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.24.0 (Ubuntu)", "content-type": "text/html; charset=utf-8", "x-powered-by": "Express" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:37:39Z", "uuid": "cbb0cd5f-f177-432f-aaab-0debf7610785", "scanned_at": "2026-08-31T08:26:44Z", "final_url": "https://krakenpipeline.com/", "status": 200, "history": [ { "url": "https://krakenpipeline.com/", "status": 200 } ], "dom_hash": "69d4b889c3ba3003ce5c6c0404d5a7d209bf1ff077d21f92e1b32e5dfc4b00a6", "doc_hash": "4151d049f2a592a36dd68cb5982d4ce949088062a07245436a582564e3ab479c", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "krakenpipeline.com", "type": "A", "value": "134.209.26.210" } ], "dnssec_valid": false, "ip": "134.209.26.210", "whois": { "registrar": "Soluciones Corporativas IP, SL", "created": "2024-10-28T09:24:02Z", "updated": "2025-10-24T08:08:33Z", "expires": "2026-10-28T09:24:02Z", "nameservers": [ "ns1.dondominio.com", "ns2.dondominio.com" ] } } } ```