krakenoniondark[.]com

PhishDestroy has identified krakenoniondark.com as an active brand impersonation phishing site, specifically targeting the Kraken cryptocurrency exchange. The domain was created on March 25, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious domains. The page title, "Kraken сайт / Кракен Даркнет / Kraken Onion / Кракен ссылка," explicitly mimics Kraken branding to deceive users into believing they are accessing a legitimate Kraken onion service or related site.

Technical indicators confirm the threat. VirusTotal reports that 10 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. The domain resolves to IP address 188.114.96.3, which is associated with Cloudflare, potentially providing the phishers with DDoS protection and anonymity. Google Safe Browsing status is not explicitly provided, but the elevated risk level and brand impersonation targeting Kraken suggest a high likelihood of user compromise if visited.

As of the current assessment, the domain remains active and poses a significant risk to Kraken users. PhishDestroy recommends that users avoid visiting this domain and report it to Kraken's security team. Organizations should block access to this domain and educate users about phishing attempts that leverage darknet or onion service branding. Continuous monitoring is advised as the threat may evolve or the domain may be used for credential harvesting or malware distribution.