blastthekraken[.]com

PhishDestroy identifies BlastTheKraken.com as an active brand impersonation domain targeting Kraken users. This domain is engineered to mimic Kraken’s branding to deploy a crypto drainer kit, a malicious script designed to siphon cryptocurrency assets from victims’ wallets upon interaction. The infrastructure and naming strategy are crafted to exploit user trust in the legitimate Kraken exchange platform. No secondary drainer kit signatures (e.g., Angel Drainer, Inferno Drainer) have been confirmed at this time, but the domain’s behavior aligns with known drainer-as-a-service (DaaS) operations observed in the wild.

This domain resolves to IP address 75.2.60.5 and is registered through Squarespace Domains LLC. Domain creation date is March 31, 2026, indicating recent deployment—an unusual timing for a legitimate financial service. VirusTotal detection rate is critically low at 1 out of 95 security vendors as of the latest scan, suggesting a high evasion profile. Google Safe Browsing (GSB) status and other blocklist counts have not been publicly confirmed, but the low VT score strongly implies limited global blocking coverage. The use of a Let's Encrypt SSL certificate (valid and not self-signed) enhances the domain’s credibility, making it more likely to bypass user scrutiny.

As of the latest intelligence, BlastTheKraken.com remains active and unblocked by major browsers or security vendors. Immediate containment actions are required: network-level blocking via DNS or firewall rules targeting IP 75.2.60.5 and domain name; browser security policy updates to flag or block the domain; and user awareness alerts to avoid visiting or interacting with the site. The elevated risk stems from the domain’s recent activation, low detection rate, and direct targeting of a reputable financial brand. Remaining risk is high due to the likelihood of continued operation and potential for domain/IP rotation. Users should verify all URLs via official Kraken channels and use hardware wallets or verified browser extensions for crypto transactions. Organizations are advised to add this domain and IP to blocklists and monitor for related artifacts in network traffic.