kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf-onion[.]com

This domain is a confirmed brand impersonation threat targeting Kraken, a major cryptocurrency exchange. The site mimics legitimate Kraken login or transaction pages to deceive users into entering credentials or transferring funds. Such impersonation domains are commonly used in crypto drainer attacks, where victims unknowingly authorize transactions that drain their wallets. The domain’s structure, including the use of an .onion address, suggests an attempt to evade detection and appear as an official darknet portal for Kraken services. Users who interact with this site risk financial loss, credential theft, and unauthorized access to their cryptocurrency holdings. Analysis indicates the domain was created on March 27, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.201.15, hosted on infrastructure associated with Cloudflare, Inc. in Canada. The domain is flagged by 8 out of 95 security vendors on VirusTotal, confirming its malicious nature. Additionally, it appears on one security blocklist and has been taken offline, though historical data remains a concern for retrospective threat analysis. The SSL certificate, issued by Let’s Encrypt (serial number E7), does not mitigate the risk, as malicious actors frequently use valid certificates to lend false legitimacy to phishing sites. Users who visited this domain should immediately revoke any active sessions or authorizations tied to Kraken or other cryptocurrency services. Change passwords for all crypto-related accounts, enable multi-factor authentication (MFA), and review transaction histories for unauthorized activity. If credentials or wallet details were entered, assume they are compromised and transfer remaining funds to a new, secure wallet. Monitor financial and account activity closely for signs of follow-up attacks, such as phishing emails or unauthorized login attempts. Organizations should update their blocklists to include this domain and its associated IP address to prevent future access. Given the elevated risk level, affected users are advised to report the incident to relevant cybersecurity authorities or their exchange’s fraud team for further investigation.