kraken-en-us-sso[.]square[.]site

Analysis of kraken-en-us-sso.square.site indicates a high‑risk brand‑impersonation campaign targeting users of the Kraken cryptocurrency exchange. The domain was registered through MarkMonitor, Inc. on 5 February 2019 and is hosted on Amazon Web Services behind Cloudflare, resolving to 74.115.51.4, an IP owned by Weebly (AS27647, United States). The site presents a page title identical to the legitimate Kraken landing page (“Kraken: Buy and sell crypto securely | kraken”), suggesting an attempt to lure victims. A Let's Encrypt certificate (E7) is active, and the authoritative nameservers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns.

HTTP requests return a 404 status, and the domain is currently taken offline. Threat intelligence sources have flagged the domain: PhishDestroy has blocked it, it appears on one security blocklist, Google Safe Browsing labels it as social engineering, and 12 of 95 VirusTotal scanners have raised detections. The campaign is classified as a crypto scam.

While the offline state prevents direct observation of malicious payloads or credential‑harvesting forms, the combination of brand‑spoofing page title, high‑risk classification, and multiple vendor detections provides sufficient confidence to treat the domain as malicious. Defenders should add the domain to URL filtering and DNS blocklists, monitor for any re‑hosting on other infrastructure, and enforce multi‑factor authentication for Kraken accounts. Ongoing observation of the associated IP range and related AWS name‑server patterns is advised to catch potential redeployment.