darknet-kraken[.]cc

PhishDestroy identifies darknet-kraken.cc as an active brand impersonation scam targeting Kraken users. The domain was registered on May 20, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 188.114.96.3. VirusTotal currently shows 3/95 detections, indicating this threat remains undetected by most antivirus engines, increasing the risk of successful deception. The domain employs a Google Trust Services SSL certificate to appear legitimate, further enhancing its credibility among potential victims.

The specific threat posed by darknet-kraken.cc is credential theft through brand impersonation. Threat actors replicate Kraken’s branding to trick users into entering login credentials, payment details, or other sensitive information. The domain’s recent creation date suggests a hastily deployed campaign, likely targeting cryptocurrency users amid volatile market conditions. Given the lack of detections on VirusTotal, the risk of user exposure remains high, as automated defenses have not yet flagged this domain. Users may unknowingly disclose credentials to attackers, leading to financial loss or account compromise.

If you visited darknet-kraken.cc, immediately change your Kraken password and enable two-factor authentication. Scan your device for malware using reputable antivirus tools and review financial accounts for unauthorized transactions. Report the domain to Kraken’s abuse team and your local cybercrime unit. Avoid interacting with the site further, as it may deploy additional malicious payloads. Monitor your email and Kraken account for suspicious activity, including phishing emails or unexpected login attempts.