kraken-log-in[.]weebly[.]com

The domain kraken-log-in.weebly.com was observed serving a page whose HTML title is "Kraken Login: Secure Access to Crypto & Bitcoin Trading". The title and the explicit brand reference indicate a targeted brand‑impersonation attempt against Kraken, and the intelligence classifies the activity as a crypto‑scam. DNS resolution points to IP address 74.115.51.9, which belongs to AS27647 (Weebly, Inc.) and is geolocated in the United States. The host is fronted by Cloudflare and presents a valid Let's Encrypt certificate (identifier E8).

An HTTP request returned a 404 status code, suggesting the page is no longer available. The domain is listed on one security blocklist and has been blocked by PhishDestroy. Google Safe Browsing flags the site for social engineering, and a VirusTotal scan recorded 11 of 95 security vendors marking the domain as malicious. Registration data shows the domain was created on March 29, 2006, registered through Safenames Ltd, and uses the nameservers ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns.

The current operational status is offline. Known information confirms the brand‑impersonation intent and the hosting infrastructure, but the actual page content, credential‑capture mechanisms, and any downstream malicious payloads remain unverified. Defenders should add kraken-log-in.weebly.com and its resolving IP 74.115.51.9 to deny‑list rules, monitor the listed nameservers for reuse, and incorporate the domain into brand‑protection feeds for Kraken. Continuous observation of Weebly‑hosted domains exhibiting similar titles or SSL configurations is recommended to detect re‑emergence of this threat actor.