Phishing Analysis: Kraken (Darknet Marketplace)

Captura Visual

Informações de Detecção

https://krakenmarket.to/

Detected Brand

Kraken (Darknet Marketplace)

Country

International

Confidence

100%

HTTP Status

200

Report ID

e041e861-9fe…

Analyzed

2026-03-06 07:05

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T137E10313114324627363B8F9F158353A7BC6E84EDB936D44A2FAA7695BE7ED0CA34108
CONTENT ssdeep	96:pPS8aO5AbgMYHlLa3YwX+u9Uzbpo4lsqxnOnqkRCpmMLvlSH5TiFeJG8hssI7:xaOqgMYlLvwOuuCqxjk5uAViF6Gaq

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	c6ce393139939393
VISUAL aHash	003c7e3c3c7e3c00
VISUAL dHash	01e4d4d4d4d4d400
VISUAL wHash	003c7e7e7e7e3c00
VISUAL colorHash	3a000000000
VISUAL cropResistant	aa004c0e0e4d4da2,e0888c8d8c0933a2,e8004c0c144e23b2,e0040d4996270f8c,e08c8d8d968c8eb2,01e4d4d4d4d4d400

Análise de Código

Risk Score 85/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Phishing/Imitação
• Alvo: Usuários do mercado Kraken
• Método: Imitando Kraken para roubar credenciais de login ou direcionar usuários para sites maliciosos.
• Exfil: Não está claro, possivelmente através do Telegram, função de calculadora (armazenamento de links), ou a própria página de login.
• Indicadores: Domínio incompatível, promoção do Telegram, recursos incomuns.
• Risco: Alto

🔒 Obfuscation Detected

fromCharCode
hex_escape
unicode_escape
js_packer
base64_strings

📊 Detalhamento da Pontuação de Risco

Total Risk Score

95/100

Contributing Factors

Domain Mismatch

The domain is not the official Kraken website.

Brand Impersonation

The site uses the Kraken logo and brand.

Unusual Functionality

Promotion of Telegram and calculator features for access/storage are red flags.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Two-Factor Authentication Stealer

Alvo

Kraken (Darknet Marketplace) users (International)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Personal Info
138 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

Kraken

Official Website

kraken.com

Fake Service

Kraken (Darknet Marketplace)

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting/Phishing

The site likely aims to steal credentials by directing the user to a malicious site or attempting to get the user to interact with a malicious script through the Telegram chat.