kraken-bestmarket[.]com

PhishDestroy identifies kraken-bestmarket.com as an active brand impersonation threat targeting Kraken users. This domain is specifically linked to a crypto drainer scheme designed to harvest credentials or funds by mimicking Kraken’s legitimate platform. No specific drainer kit name is disclosed, but the threat profile aligns with common crypto credential theft tactics.

Technical indicators for kraken-bestmarket.com include a VirusTotal detection rate of 2 out of 95 security vendors, indicating some recognition by antivirus tools though not widespread. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and was created recently on April 19, 2025. It resolves to IP address 172.67.196.166 and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of security to unsuspecting users. Google Safe Browsing (GSB) status is not explicitly noted as blocked, but two vendors flagging it suggests emerging recognition of malicious activity.

Currently, kraken-bestmarket.com remains active and poses an elevated risk to anyone attempting to access Kraken services via this domain. PhishDestroy recommends users avoid interaction with this site and verify any Kraken-related URLs through trusted channels or official Kraken communications. Security teams should monitor for any escalation in detection rates and consider blocking the IP or domain at network perimeters. While only 2 out of 95 vendors have flagged the domain so far, the impersonation tactic and recent creation date warrant caution as attackers may update their infrastructure or expand their reach.