krakendluginewsusa[.]godaddysites[.]com

The domain krakendluginewsusa.godaddysites.com was observed hosting a page titled “Kr𝖆ken Loℊin | Loℊ In”. The title incorporates the Kraken brand, indicating an attempt to impersonate the cryptocurrency exchange. Technical checks show the site resolves to the Amazon‑owned IP address 76.223.105.230, which is assigned to ASN 16509 (Amazon.com, Inc.) and is located in the United States. The domain is registered through GoDaddy.com, LLC, with the standard GoDaddy nameservers cns1.secureserver.net and cns2.secureserver.net. An SSL certificate issued by Go Daddy Secure Certificate Authority – G2 is present, confirming that HTTPS is enabled but offering no additional trust.

The HTTP response returned a 404 status code, and the site has been taken offline at the time of analysis. Nonetheless, the domain was flagged by the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal scans reported 16 detections out of 95 scanners, reinforcing the malicious classification. The domain was created on 18 November 2013, which suggests long‑term control by the operator.

Evidence points to a cryptocurrency‑related scam that leverages the Kraken brand to lure victims, although the exact payload or credential‑capture mechanism is not visible from the available data. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any re‑hosting of the same content on related infrastructure, and add the associated IP address 76.223.105.230 to threat‑intel feeds. Because the site is currently offline, any future resurrection would likely reuse the same hosting provider and SSL certificate, so alerts on new subdomains under godaddysites.com that reference Kraken should be generated. Further investigation is required to determine whether the operator has reused the same certificate or infrastructure for other malicious domains.