krakenlinker[.]cc

On July 07, 2025, the domain krakenlinker.cc was registered and configured to impersonate the cryptocurrency exchange Kraken, making it a targeted brand impersonation threat. This domain is actively leveraging Kraken’s branding to deceive users into entering sensitive credentials or cryptocurrency wallet information. It operates as a drainer kit, likely designed to siphon funds or harvest login data through a convincing fake interface.

Technical indicators confirm elevated risk: PhishDestroy identifies this domain with a VirusTotal detection score of 4 out of 95 security vendors, indicating limited but present recognition of its malicious nature. The domain resolves to IP address 104.21.32.222 and is associated with a Google Trust Services SSL certificate, suggesting an attempt to appear legitimate. NICENIC INTERNATIONAL GROUP CO., LIMITED registered the domain, and it has been flagged on a single security blocklist. The domain was created on July 07, 2025, aligning with the observed activity timeline.

Currently, krakenlinker.cc remains active, with PhishDestroy having blocked access to mitigate immediate risk. However, the domain’s recent creation and low detection rate (4/95) suggest it may still be evolving or evading detection by some security tools. Users and organizations should avoid interacting with this domain and ensure protective measures such as DNS filtering and endpoint monitoring are in place. Remaining risk is elevated due to the active status and the domain’s attempt to exploit trust in the Kraken brand.