kraikenliggin[.]godaddysites[.]com

This report details a fraudulent website designed to impersonate the legitimate Kraken cryptocurrency exchange platform. The site was titled "Ǩraken Ḹogin | Sign in to Ǩraken Ŀogin," using homoglyph characters in the brand name to visually deceive users into believing they were accessing an official Kraken login page. The primary threat was credential harvesting, where users attempting to sign in would have their account credentials and potentially other sensitive information stolen by the threat actor.

Technical analysis confirms the malicious nature of this site. VirusTotal scans returned 12 detections out of 95 security vendors. The domain was flagged as a threat by ChainPatrol, alphaMountain.ai, BitDefender, CRDF, and ESET, and was listed on 1 blocklist. The site was hosted on IP address 13.248.243.5, located in the United States and belonging to AS16509 Amazon.com, Inc. The domain was registered through GoDaddy.com, LLC, and was created on 2013-11-18. The SSL certificate was issued by GoDaddy Secure Certificate Authority - G2, providing a false sense of security to visitors.

As of the time of analysis, the site is reported as DOWN or OFFLINE, rendering it inaccessible. The overall risk level is considered high for any users who may have previously visited the site or entered credentials, as the captured data is likely already compromised. Users are advised to change any passwords used on the fraudulent site and enable multi-factor authentication on their legitimate Kraken accounts.