Phishing Analysis: Kraken (Darknet Marketplace)

Visual Capture

Detection Info

https://krakenmarket.to/

Detected Brand

Kraken (Darknet Marketplace)

Country

International

Confidence

100%

HTTP Status

200

Report ID

e041e861-9fe…

Analyzed

2026-03-06 07:05

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T137E10313114324627363B8F9F158353A7BC6E84EDB936D44A2FAA7695BE7ED0CA34108
CONTENT ssdeep	96:pPS8aO5AbgMYHlLa3YwX+u9Uzbpo4lsqxnOnqkRCpmMLvlSH5TiFeJG8hssI7:xaOqgMYlLvwOuuCqxjk5uAViF6Gaq

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	c6ce393139939393
VISUAL aHash	003c7e3c3c7e3c00
VISUAL dHash	01e4d4d4d4d4d400
VISUAL wHash	003c7e7e7e7e3c00
VISUAL colorHash	3a000000000
VISUAL cropResistant	aa004c0e0e4d4da2,e0888c8d8c0933a2,e8004c0c144e23b2,e0040d4996270f8c,e08c8d8d968c8eb2,01e4d4d4d4d4d400

Code Analysis

Risk Score 85/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing/Impersonation
• Target: Users of Kraken marketplace
• Method: Impersonating Kraken to steal login credentials or direct users to malicious sites.
• Exfil: Unclear, possibly through Telegram, calculator feature (storing links), or the login page itself.
• Indicators: Mismatched domain, promotion of Telegram, unusual features
• Risk: High

🔒 Obfuscation Detected

fromCharCode
hex_escape
unicode_escape
js_packer
base64_strings

📊 Risk Score Breakdown

Total Risk Score

95/100

Contributing Factors

Domain Mismatch

The domain is not the official Kraken website.

Brand Impersonation

The site uses the Kraken logo and brand.

Unusual Functionality

Promotion of Telegram and calculator features for access/storage are red flags.

🔬 Comprehensive Threat Analysis

Threat Type

Two-Factor Authentication Stealer

Target

Kraken (Darknet Marketplace) users (International)

Attack Method

Brand impersonation + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Personal Info
138 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Kraken

Official Website

kraken.com

Fake Service

Kraken (Darknet Marketplace)

⚔️ Attack Methodology

Primary Method: Credential Harvesting/Phishing

The site likely aims to steal credentials by directing the user to a malicious site or attempting to get the user to interact with a malicious script through the Telegram chat.