kraken-29[.]cc

The domain kraken-29.cc is a confirmed phishing site engaged in brand impersonation targeting Kraken, a well-known cryptocurrency exchange. It presents itself as a legitimate Kraken login portal but is designed to steal user credentials through a fraudulent interface. No cryptocurrency drainer kit was detected, but the site poses an elevated risk due to its active credential-harvesting operation. As of the latest verification, kraken-29.cc has been taken offline.

Technical analysis reveals that kraken-29.cc was flagged by 16 of 95 security vendors on VirusTotal, including ADMINUSLabs, ChainPatrol, and alphaMountain.ai. The domain was registered through NiceNIC International Group Co., Limited on March 12, 2025, and resolves to the IP address 172.67.166.60, hosted on Cloudflare’s infrastructure (AS13335). It appears on one security blocklist, PhishDestroy, and uses an SSL certificate issued by Google Trust Services (WE1). The observed page title, 'Kraken Market - Вход на сайт,' further confirms its intent to impersonate Kraken’s login page. The domain’s Gridinsoft trust score is 0 out of 100, reinforcing its malicious nature.

Users who interacted with kraken-29.cc should immediately change their Kraken account passwords and enable two-factor authentication (2FA) if not already active. Monitor account activity for unauthorized transactions or logins and report any suspicious behavior to Kraken’s official support channels. To report the phishing domain, submit it to Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG). If credentials were entered, assume they are compromised and avoid reusing them on other platforms.