kraken6gf6o4rxewycqwjgfchzgxyfeoj5xafqbfm4vgvyaig2vmxvyd0[.]com

PhishDestroy identifies kraken6gf6o4rxewycqwjgfchzgxyfeoj5xafqbfm4vgvyaig2vmxvyd0.com as an active brand-impersonation domain currently under investigation. This site mimics the Kraken cryptocurrency exchange and serves a fake login portal designed to harvest credentials and push a crypto-draining malware payload. The page title explicitly references a Kraken onion mirror, indicating an attempt to lend legitimacy to the fraudulent site. This domain was flagged by PhishDestroy on August 17, 2025, the same day it was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. Security scans show 0 detections out of 95 engines on VirusTotal, and the domain resolves to IP 188.114.96.3. Despite the absence of AV detections, the onion mirror reference and SSL certificate issued by Google Trust Services are red flags commonly used in sophisticated phishing operations targeting crypto users. Users who visited this domain should immediately check their browser for any downloaded files or extensions and revoke any permissions granted to unknown scripts. If credentials were entered, rotate passwords and enable two-factor authentication on legitimate Kraken accounts. Scan devices with updated antivirus software and report the domain to PhishDestroy for further analysis and blocking assistance.