kraken-login-en-us[.]blogspot[.]com

The domain kraken-login-en-us.blogspot.com was observed hosting a page titled “Kraken Login”. The page title and the explicit indication that the site impersonates Kraken identify the campaign as a brand‑impersonation crypto‑scam. The site was registered through Google’s registrar and is associated with ASN 15169, the Google network, which resolves to IP 192.178.155.132 located in the United States. The SSL certificate presented is issued by Google Trust Services under the “WE2” profile, which is typical for Blogger‑hosted content and does not provide any cryptographic assurance of legitimacy beyond the platform’s standard TLS. Technical fingerprints show the use of Blogger as the hosting platform together with Java, Python, OpenGSE libraries and support for HTTP/3, consistent with a generic web‑app stack rather than a specialized phishing kit.

Google Safe Browsing flagged the URL for social‑engineering, and the domain appears on at least one public blocklist. PhishDestroy has also listed the domain as blocked. VirusTotal scans returned 16 detections out of 95 security vendors, indicating that a significant minority of scanners recognize malicious behavior. The HTTP response returned a 404 status, and the nameserver query returned “NS_NOT_FOUND”, suggesting that the domain may have been removed from active DNS resolution at the time of analysis. The current status is recorded as offline.

Evidence points to a coordinated attempt to lure victims into entering Kraken credentials or cryptocurrency details, yet the exact landing page content has not been captured, leaving the precise credential‑capture mechanism uncertain. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any residual DNS queries, and add the associated IP address to reputation lists.