kraken-login[.]created[.]app

On July 24, 2026, analysis of the domain kraken-login.created.app confirms that it was actively used to host a cryptocurrency‑related impersonation site targeting users of the Kraken exchange. The page title returned by the server is "Kraken Login", matching the brand target listed in the intelligence. The domain was registered through Tucows Domains Inc. on 12 July 2023 and resolves to the IP address 216.150.16.1, which belongs to Amazon.com, Inc. (AS16509) and is physically located in the United States. DNS resolution is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com, indicating that the site was hosted on the Vercel platform.

HTTP requests receive a 404 status code, and the TLS certificate is issued by Let’s Encrypt (R13) with HSTS enabled, which is consistent with a short‑lived malicious deployment. Threat intelligence feeds have flagged the domain on at least one security blocklist and Google Safe Browsing classifies it as a social‑engineering site. VirusTotal reports that 11 out of 95 scanners label the domain as malicious, and PhishDestroy has also blocked it.

The current operational status is offline, suggesting the operators have taken the site down, but the underlying infrastructure – the Vercel‑hosted domain and the Amazon‑owned IP address – remains reusable for future campaigns. Defenders should add the domain and its associated IP address to deny‑list rules, monitor new subdomains under the same registrar and nameserver pair, and enforce strict outbound filtering for URLs containing "kraken-login" or similar patterns. Continuous re‑evaluation of the IP block for suspicious activity is recommended, as the hosting provider may be leveraged again for brand‑impersonation attacks.