krakenlighter[.]com

PhishDestroy identifies krakenlighter.com as an active brand impersonation domain targeting Kraken users. This malicious domain mimics the official Kraken cryptocurrency exchange branding to deceive victims into entering sensitive credentials or cryptocurrency wallet information. The site appears designed to harvest login details or initiate unauthorized transactions, aligning with tactics commonly associated with crypto drainer toolkits.

This domain resolves to IP 38.14.63.108 and was registered on February 28, 2026 through GMO Internet, Inc. using a Let's Encrypt SSL certificate. As of the latest scan, VirusTotal reports 2 out of 95 detection engines flagged the domain, indicating it remains largely undetected by mainstream security tools. No evidence of a known crypto drainer kit (e.g., Inferno, Angel Drainer) has been confirmed at this stage, though the behavioral pattern strongly suggests impersonation with theft intent.

At present, krakenlighter.com remains active and under investigation. There are no confirmed entries in public blocklists or Google Safe Browsing (GSB) at this time. The domain poses a moderate risk due to its recent creation, low detection rate, and direct targeting of a major crypto brand. Users are advised to avoid accessing the site, report it to their security teams or browser vendors, and verify all cryptocurrency-related domains against official Kraken domains (kraken.com). While risk is classified as 'under_investigation', immediate caution is warranted given the potential for credential theft or fund loss.