kraaken[.]idlogin-auth[.]com

The domain kraaken.idlogin-auth.com was registered on 27 February 2026 through NiceNIC International Group Co., Limited and is hosted on the IP address 192.241.120.160, which belongs to AS55286 B2 Net Solutions Inc. in the Netherlands. The authoritative name servers are pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net and pns74.cloudns.uk. No TLS certificate was observed; HTTP requests return the default nginx welcome page titled “Welcome to nginx!”, indicating a lack of a legitimate login interface. The site is classified as a crypto‑scam that impersonates the Kraken exchange, and it has been flagged by seven of ninety‑three VirusTotal scanners.

It appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask and SEAL. As of the report date (24 July 2026) the host is offline, which limits real‑time analysis of payloads or phishing pages. Evidence suggests the operator leveraged a generic cloud‑hosting provider and a popular DNS service to achieve rapid deployment. Defenders should continue to monitor the IP range associated with AS55286, enforce domain‑based blocking for any sub‑domains of idlogin-auth.com, and update email and web filtering rules to include the full domain string.

Because the site currently returns only an nginx placeholder, any future activation is likely to involve a forged Kraken login page or cryptocurrency withdrawal prompt. Continuous threat‑intel feeds, especially those from the blocklist providers that already listed this domain, should be consulted for updates. Organizations using Kraken services should educate users about unsolicited login requests and verify URLs against the official Kraken domain. The lack of SSL, the recent registration date, and the rapid blocklist inclusion are consistent with a short‑lived impersonation campaign.