kraken-zerkalo-slon[.]info

PhishDestroy identifies kraken-zerkalo-slon.info as an active crypto drainer phishing domain designed to steal cryptocurrency assets from unsuspecting users. This domain mimics legitimate cryptocurrency platforms, specifically targeting victims with fake login portals or fraudulent transaction pages. The threat actor behind this campaign employs social engineering tactics, such as impersonating well-known exchanges, to trick users into entering their credentials or authorizing malicious transactions. Technical analysis reveals that the domain was registered through Dynadot Inc and resolves to IP address 172.67.177.48, which hosts the malicious infrastructure. Users should exercise extreme caution when encountering this domain, as it is engineered to drain crypto wallets and exfiltrate sensitive financial data.

This domain exhibits multiple red flags that confirm its malicious intent. According to VirusTotal scans, kraken-zerkalo-slon.info currently shows 1 out of 95 detections, indicating that it has evaded detection by most antivirus engines. The domain was created on May 07, 2026, suggesting a recent and potentially opportunistic campaign. Additionally, it utilizes Cloudflare nameservers (amos.ns.cloudflare.com and kay.ns.cloudflare.com) to obscure its hosting infrastructure, a common tactic among threat actors to delay takedowns. While the exact blocklist count is not provided, the absence of detections highlights the domain's stealthy operation and the need for proactive threat intelligence.

If you have visited kraken-zerkalo-slon.info, PhishDestroy advises immediate action to mitigate potential risks. Disconnect any affected devices from the internet to prevent further unauthorized access or data exfiltration. Check your cryptocurrency wallets and exchange accounts for unauthorized transactions or suspicious activity. Enable two-factor authentication (2FA) on all critical accounts and consider revoking any API keys or permissions granted to unknown or untrusted applications. Report the domain to PhishDestroy for further analysis and to help protect the broader community. Stay vigilant by verifying URLs before interacting with them and avoid entering sensitive information on unfamiliar websites.