kraken-guide[.]top

PhishDestroy identifies kraken-guide.top as an active brand impersonation domain targeting Kraken cryptocurrency exchange users. This domain is currently under investigation as part of a suspected phishing campaign designed to deceive victims into disclosing sensitive credentials or cryptocurrency wallet information under the guise of providing trading guides or support services. There is no confirmed drainer kit associated with this domain at this time, but its rapid registration and low VirusTotal detection rate suggest an emerging threat vector.

This domain exhibits multiple red flags consistent with malicious infrastructure. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 23, 2026, kraken-guide.top resolves to IP address 172.67.175.115, a Cloudflare IP often leveraged in phishing operations to obscure origin and evade takedown efforts. The domain operates with a valid Let's Encrypt SSL certificate, increasing its legitimacy to unsuspecting users. Critically, this domain remains undetected on VirusTotal with a score of 3/95 detections as of the latest scan. It is not currently flagged by Google Safe Browsing (GSB) and has not been added to public blocklists, indicating a newly deployed and unmitigated threat. The combination of low detection, recent registration, and brand impersonation creates a high-risk scenario for Kraken users seeking support or educational resources.

As of this report, kraken-guide.top remains active and unblocked. PhishDestroy has flagged this domain for immediate analysis and escalation to ISP and domain registrars for deactivation. Users are advised to avoid accessing this domain and report any related phishing attempts to Kraken’s official support and relevant cybersecurity authorities. While the immediate risk is elevated due to zero detections, proactive blocking by security teams can prevent potential victimization. The investigation continues to monitor for additional infrastructure or drainer components linked to this campaign. Remaining risk is assessed as moderate-to-high pending takedown or deactivation.