krakenorlogin[.]godaddysites[.]com

This domain, krakenorlogin.godaddysites.com, is assessed at a high risk level due to its specific threat type of brand impersonation. The domain impersonates the well-known cryptocurrency exchange, Kraken, and poses a significant threat to users who may be tricked into providing sensitive information.

Infrastructure analysis reveals that the domain was created on November 18, 2013, and is registered through GoDaddy.com, LLC. It resolves to the IP address 76.223.105.230, which is located in the United States and is associated with Amazon.com, Inc. (AS16509). The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. The domain has been flagged by 22 out of 95 security vendors on VirusTotal, indicating a moderate level of detection among security services. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, and has been flagged by Google Safe Browsing for phishing activities. These indicators collectively suggest that the domain has been used in malicious campaigns aimed at defrauding Kraken users.

To mitigate the risks associated with brand impersonation, users are advised to verify the URL and domain of any login pages they access, ensuring they are on the official Kraken website. Security teams should monitor for similar domain names and IP addresses, and consider implementing domain monitoring and takedown services. Organizations should also educate their users about the signs of phishing, such as unexpected emails, urgent requests, and suspicious links, and encourage the use of multi-factor authentication to protect against credential theft.