razer-kraken-onion[.]com

PhishDestroy identifies razer-kraken-onion.com as an active brand impersonation domain targeting Kraken users. The site mimics the legitimate Kraken brand to deceive victims into divulging credentials or transferring cryptocurrency. Security telemetry confirms the presence of a drainer kit associated with this infrastructure, designed to siphon assets under the guise of a legitimate service.

This domain was flagged by PhishDestroy with a VirusTotal detection score of 1 out of 95 security vendors, indicating low but notable detection coverage. The domain resolves to IP address 172.67.168.13 and was registered through Fewmoretaps OU d/b/a Trustname.com on December 12, 2025. An SSL certificate issued by Google Trust Services is in use, which may contribute to a false sense of legitimacy. As of the latest assessment, the domain remains active and unlisted on major blocklists.

The current status of razer-kraken-onion.com is classified as active with elevated risk due to ongoing impersonation of the Kraken brand and the presence of drainer infrastructure. Response actions include domain takedown notifications to the registrar and hosting provider, and coordination with Kraken’s abuse desk for victim remediation support. Despite these actions, residual risk remains high due to the domain’s short operational lifespan and the adversary’s likely intent to rapidly cycle infrastructure. Users are advised to avoid this domain entirely and report any interactions to Kraken’s official support channels.