krakenlink-market[.]cc

PhishDestroy identifies krakenlink-market.cc as an active brand-impersonation domain targeting Kraken users. The site mimics the legitimate Kraken exchange to harvest credentials or deploy a crypto-draining kit against connected wallets. No specific drainer kit was observed in automated scans, but the page title exactly matches the domain name, indicating a hastily assembled landing page designed for quick credential theft and wallet draining. The absence of TLS and the presence of only a basic HTML form further suggest a low-fidelity but high-impact campaign aimed at unsuspecting users seeking “quick links” to Kraken services. krakenlink-market.cc was first registered on March 13, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Public DNS resolves the domain to IP 86.54.25.38, a hosting range associated with multiple low-reputation domains. VirusTotal analysis reveals detection by 13 of 95 security engines as of the latest scan, placing the domain at elevated risk. Google Safe Browsing has not yet flagged the domain, and third-party blocklists currently show zero detections, indicating rapid emergence and low prior exposure. WHOIS data reveals a registrant privacy shield, obscuring true ownership and increasing operational security for the threat actor. This domain remains active and poses an elevated threat to cryptocurrency users. Immediate containment measures include DNS sinkholing of 86.54.25.38 and domain takedown requests directed at NICENIC and upstream providers. Users are strongly advised to verify any Kraken-related links via official channels and to revoke any wallet connections made after visiting this domain. Ongoing monitoring is required, as the threat actor may rapidly shift infrastructure or refine lures. Remaining risk remains high due to the fresh registration, low blocklist coverage, and the high-value target of major cryptocurrency exchanges.