kraken-sait[.]icu

PhishDestroy identifies kraken-sait.icu as an active brand impersonation domain designed to impersonate the cryptocurrency exchange Kraken. The site employs a crypto drainer kit delivered through deceptive landing pages that mimic Kraken’s official branding and login flows. Upon user interaction, the drainer automatically connects to a wallet and transfers digital assets to addresses controlled by the threat actor, resulting in immediate financial loss. kraken-sait.icu resolves to IP address 104.21.29.8 and was registered on April 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED using a Let’s Encrypt SSL certificate. VirusTotal analysis shows 0 detections out of 95 security engines as of the latest scan. Google Safe Browsing (GSB) has not yet flagged the domain, and third-party threat intelligence sources report zero known blocklist entries. The combination of recent registration, low VT coverage, and impersonation of a major crypto brand indicates a newly deployed, stealthy campaign with high evasion potential. As of this investigation, kraken-sait.icu remains active and unblocked by major browsers and security vendors. The domain exhibits clear indicators of malicious intent including brand misuse and automated crypto theft functionality. Immediate defensive actions include blocking the domain and IP at network and endpoint levels, updating user awareness training to recognize similar impersonation attempts, and reporting the domain to relevant threat intelligence platforms and the targeted brand. While the immediate risk is elevated due to low detection coverage, proactive blocking and public disclosure can significantly reduce exposure and prevent further victimization.