krakonl0gin[.]wordpress[.]com

The domain krakonl0gin.wordpress.com was observed on July 23, 2026 and is currently listed as offline with an HTTP 410 response code, indicating the resource has been removed. Infrastructure analysis shows the site was hosted on the Automattic network (AS2635) in the United States, resolving to IP address 192.0.78.12. The name servers ns1‑ns4.wordpress.com confirm that the domain leveraged the standard WordPress hosting environment, consistent with the detected technology stack of WordPress, MySQL, PHP, Nginx, HTTP/3, and enforced HSTS. A Let’s Encrypt certificate (E8) was provisioned for the sub‑domain, providing TLS encryption but not implying legitimacy.

Registration data reveal the domain was created on March 03, 2000 and is registered through MarkMonitor, Inc., a registrar often associated with brand‑protected domains, suggesting the registration predates the malicious activity. VirusTotal scans returned 13 positive detections out of 95 security vendors, indicating a moderate consensus among scanners that the domain exhibits malicious characteristics. The page title captured from the site, "Kráken Lógin : Bitcoin & Cryptocurrency Exchange," explicitly references Bitcoin, confirming the impersonation of the cryptocurrency brand. The site was classified as a crypto scam and has been added to at least one security blocklist, with PhishDestroy actively blocking the domain.

While the site is no longer reachable, the combination of a brand‑specific title, multiple vendor detections, and blocklist inclusion provides strong evidence of a targeted brand‑impersonation campaign. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds, and monitor for any re‑registration attempts that reuse the same sub‑domain pattern. Incident response teams should also audit any internal logs for connections to 192.0.78.