kraken-darknet[.]market

The domain kraken-darknet.market has been identified as a brand impersonation phishing site targeting Kraken, a well-known cryptocurrency exchange platform. Analysis indicates the domain was specifically designed to mimic legitimate Kraken infrastructure, likely to deceive users into divulging credentials or sensitive financial information. The domain is currently offline, though prior activity suggests a high-risk profile for potential victims. Infrastructure analysis reveals the domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu on March 30, 2026, and resolved to the IP address 188.114.96.3. Security telemetry shows the domain was flagged by 2 of 95 security vendors on VirusTotal, while Gridinsoft assigned it a trust score of 0/100. The domain appears on one security blocklist and was referenced in a single AlienVault OTX threat intelligence pulse. Additionally, PhishDestroy previously blocked access to this domain, further corroborating its malicious classification. Given the domain’s current offline status, no active threat is present; however, historical indicators suggest it was part of a broader phishing campaign. Organizations and users are advised to monitor for similar impersonation domains, particularly those targeting cryptocurrency platforms. Network defenders should block the domain and associated IP (188.114.96.3) at the perimeter, while users should verify domain authenticity before interacting with any financial or cryptocurrency-related services. Continuous vigilance and threat intelligence integration are recommended to mitigate future risks from similar infrastructure.