krakenlogenhelp[.]wordpress[.]com

Analysis conducted on July 25, 2026 identifies the sub‑domain krakenlogenhelp.wordpress.com as a confirmed impersonation of the Kraken cryptocurrency exchange. The site presents the page title “Krẚken Lǒgin”, which aligns with the brand‑impersonation indicator. Technical fingerprinting shows a typical WordPress stack: MySQL, PHP, Nginx, HSTS and HTTP/3 support, all delivered under a Let's Encrypt certificate (issuer E8) that was valid at the time of capture. An HTTP 410 response indicates the content has been removed, and the domain is currently offline. DNS resolution points to 192.0.78.13, an address owned by AS2635 Automattic, Inc. in the United States and served by the standard WordPress nameservers (ns1‑ns4.wordpress.com).

Registration records list MarkMonitor, Inc. as the registrar, with the domain creation date recorded as March 03, 2000. Google Safe Browsing classifies the URL as “social engineering”, and PhishDestroy has actively blocked it. VirusTotal analysis shows that eight of ninety‑three scanning engines flagged the domain, confirming malicious intent. The domain also appears on a single external security blocklist. The combined evidence—brand‑targeted page title, crypto‑scam classification, safe‑browsing warning, multiple vendor detections, and blocklist presence—supports an elevated risk rating.

Defenders should add krakenlogenhelp.wordpress.com and its resolved IP 192.0.78.13 to deny‑list rules across perimeter firewalls, DNS sinks, and web proxies. Continuous monitoring of the associated AS2635 range is advised in case the actors reactivate the site on a different host. Because the site is already returning HTTP 410, automated takedown requests to the WordPress hosting provider may be unnecessary, but confirming removal with the registrar (MarkMonitor) can prevent future re‑registration.