sso-kraken-en[.]square[.]site

The domain sso-kraken-en.square.site impersonates the cryptocurrency exchange Kraken. It aims to deceive users into providing sensitive information under the guise of a legitimate login page. Despite being offline now, it was flagged by 15 out of 95 vendors on VirusTotal, indicating significant detection by security systems.

Registered through MarkMonitor, Inc., and hosted by Weebly, Inc. in the US, this domain used Let's Encrypt for SSL certification. The page title 'Sign in to Kraken - Kraken | Buy, Sell and Margin Trade Bitcoin | trezore' suggests the attackers aimed to exploit Kraken's reputation to lure users into a fake login process. This type of phishing attack is particularly dangerous as it targets cryptocurrency users, who are often handling significant financial assets.

PhishDestroy identified this domain on November 27, 2025, and it is currently listed on one public blocklist. The domain's creation dates back to February 5, 2019, indicating it may have been dormant or used intermittently for malicious activities. Its presence in a public blocklist highlights its recognition as a threat in the cybersecurity community.

Phishing domains like sso-kraken-en.square.site exploit the critical time window between domain registration and widespread detection by antivirus vendors. PhishDestroy's early detection capabilities help mitigate risks during this vulnerable period, providing crucial protection against emerging threats. The domain's takedown reduces its immediate threat, but the incident underscores the ongoing risks posed by phishing schemes targeting cryptocurrency platforms.