Phishing Analysis: Kraken (Darknet Marketplace)

Captura Visual

Información de Detección

https://krakenmarket.to/

Detected Brand

Kraken (Darknet Marketplace)

Country

International

Confidence

100%

HTTP Status

200

Report ID

e041e861-9fe…

Analyzed

2026-03-06 07:05

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T137E10313114324627363B8F9F158353A7BC6E84EDB936D44A2FAA7695BE7ED0CA34108
CONTENT ssdeep	96:pPS8aO5AbgMYHlLa3YwX+u9Uzbpo4lsqxnOnqkRCpmMLvlSH5TiFeJG8hssI7:xaOqgMYlLvwOuuCqxjk5uAViF6Gaq

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	c6ce393139939393
VISUAL aHash	003c7e3c3c7e3c00
VISUAL dHash	01e4d4d4d4d4d400
VISUAL wHash	003c7e7e7e7e3c00
VISUAL colorHash	3a000000000
VISUAL cropResistant	aa004c0e0e4d4da2,e0888c8d8c0933a2,e8004c0c144e23b2,e0040d4996270f8c,e08c8d8d968c8eb2,01e4d4d4d4d4d400

Análisis de Código

Risk Score 85/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing/Impersonación
• Objetivo: Usuarios del mercado Kraken
• Método:  Imitando a Kraken para robar credenciales de inicio de sesión o dirigir a los usuarios a sitios maliciosos.
• Exfil: No está claro, posiblemente a través de Telegram, la función de calculadora (almacenamiento de enlaces), o la propia página de inicio de sesión.
• Indicadores: Dominio no coincidente, promoción de Telegram, características inusuales.
• Riesgo: Alto

🔒 Obfuscation Detected

fromCharCode
hex_escape
unicode_escape
js_packer
base64_strings

📊 Desglose de Puntuación de Riesgo

Total Risk Score

95/100

Contributing Factors

Domain Mismatch

The domain is not the official Kraken website.

Brand Impersonation

The site uses the Kraken logo and brand.

Unusual Functionality

Promotion of Telegram and calculator features for access/storage are red flags.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Two-Factor Authentication Stealer

Objetivo

Kraken (Darknet Marketplace) users (International)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Personal Info
138 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Kraken

Official Website

kraken.com

Fake Service

Kraken (Darknet Marketplace)

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting/Phishing

The site likely aims to steal credentials by directing the user to a malicious site or attempting to get the user to interact with a malicious script through the Telegram chat.