i-kraken[.]ru

PhishDestroy identifies i-kraken.ru as an active brand impersonation domain targeting Kraken users. The domain was registered on May 04, 2025 through BEGET-RU and resolves to IP 5.101.152.161. Despite zero VirusTotal detections (0/95), the site’s title explicitly mirrors the legitimate Kraken brand, indicating a high-risk attempt to deceive visitors into sharing credentials or transferring cryptocurrency.

Technical indicators reveal a newly created domain with no established presence or trust scores, relying solely on the resemblance to Kraken’s brand to attract victims. The absence of blocklist entries suggests the domain is currently undetected by many security systems, but the impersonation tactic is a well-documented vector for credential theft and crypto drainer campaigns. Registrar choice and hosting location do not inherently flag the domain, but the timing and branding alignment are consistent with malicious intent.

Mitigation steps for users and organizations include blocking the domain i-kraken.ru at the network and DNS levels, reporting the domain to Kraken’s abuse team and platforms like VirusTotal, and educating teams about verifying domain spellings and SSL certificates. For crypto users, enabling hardware wallet confirmations and avoiding click-through links in unsolicited communications can reduce exposure to drainer scripts. Proactive threat intelligence sharing and domain reputation monitoring are critical to prevent further impersonation campaigns.