krakenloogin[.]wordpress[.]com

This domain, krakenloogin.wordpress.com, has been identified as a crypto‑related brand‑impersonation site targeting users of the Kraken exchange. The site is hosted on the WordPress.com platform, as indicated by the page title “WordPress.com — Get a Free Blog Here” and the presence of WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3 in the technology fingerprint. The domain was created on 3 March 2000 and is registered through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services. DNS resolution points to 192.0.78.13, an IP address owned by AS2635 Automattic, Inc. in the United States. The server presents a Let’s Encrypt certificate (E8) and enforces HSTS, which is typical for legitimate WordPress blogs but does not mitigate the malicious purpose.

The HTTP response for the host returns a 410 Gone status, indicating that the content has been removed; the site is currently offline. Despite the removal, the infrastructure remains listed on a single security blocklist and is flagged by Google Safe Browsing for social engineering. PhishDestroy has also blocked the domain, and VirusTotal records show that 7 of 95 scanners flagged the domain as malicious, corroborating the suspicion of abuse. The site was categorized as a “Crypto Scam” and explicitly impersonates the Kraken brand.

Evidence gaps include the absence of a live page snapshot, so the exact phishing content, credential‑capture mechanisms, or malicious payloads cannot be confirmed. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑appearance of the subdomain, and add the IP address 192.0.78.13 to any threat‑intel feeds that track malicious activity originating from Automattic infrastructure. Because the registrar is a reputable brand‑protection service, any future registration attempts for similar subdomains should be reported to MarkMonitor for potential takedown.