kraken2trfqodivdlh4ab337cpzfrhldfdlhev5fn7njhurmw7instad-onion[.]ru

PhishDestroy identifies kraken2trfqodivdlh4ab337cpzfrhldfdlhev5fn7njhurmw7instad-onion.ru as an active brand impersonation domain leveraging Kraken’s identity to deploy a drainer kit. The domain, registered through REGRU-RU on April 10, 2026, and resolving to 104.21.84.176, mirrors Kraken’s branding to deceive users into transferring cryptocurrency to attacker-controlled wallets. Let’s Encrypt issued the SSL certificate, providing a veneer of legitimacy to the fraudulent site. Security vendors have already begun flagging this domain, with 4 out of 95 detecting it as malicious, underscoring its elevated risk profile. This domain was flagged with a VirusTotal score of 4/95, indicating early-stage detection by security tools. The registrar, REGRU-RU, is a known facilitator of malicious domains, while the hosting IP 104.21.84.176 has been linked to cryptocurrency-related fraud in prior investigations. The domain’s creation date of April 10, 2026, suggests a recent campaign, with Google Safe Browsing (GSB) status and blocklist counts pending further analysis. The drainer kit embedded within the site is designed to siphon funds from unsuspecting victims, emphasizing the need for immediate action. As of this advisory, kraken2trfqodivdlh4ab337cpzfrhldfdlhev5fn7njhurmw7instad-onion.ru remains active, with no confirmed takedown at this time. Users are urged to block the domain at the network level and update their threat intelligence feeds to include this indicator. The remaining risk is elevated, as the domain’s infrastructure and SSL certificate suggest a sophisticated attempt to exploit trust in the Kraken brand. Organizations should monitor for related infrastructure and update their defenses to mitigate potential losses.