krakenlogin1[.]website3[.]me

Analysis of krakenlogin1.website3.me indicates a high‑risk crypto‑related impersonation campaign targeting the Kraken brand. The site, currently offline, returned an HTTP 404 status when queried, suggesting the landing page has been removed or is no longer serving content. Metadata collected from the domain reveals that it was registered on July 28, 2017 through In2net Network Inc., and that its authoritative nameserver information could not be resolved (NS_NOT_FOUND). Infrastructure inspection shows the domain resolves to IP address 198.245.53.228, which is hosted in Canada under AS16276 operated by OVH SAS.

The server stack combines Microsoft ASP.NET with Nginx, and the TLS certificate presented is issued by DigiCert Inc under the RapidSSL TLS RSA CA G1 hierarchy, indicating a legitimate‑looking HTTPS configuration. Reputation services flag the domain as malicious: Google Safe Browsing classifies it as social engineering, and twelve of ninety‑five VirusTotal scanners have marked it as malicious. The domain appears on one external blocklist and has been actively blocked by the PhishDestroy mitigation service. The page title captured before takedown reads "Kraken Login | Buy and Sell Bitcoin | Trade Bitcoin & Ethereum," reinforcing the claim that the site attempted to masquerade as an official Kraken login portal for cryptocurrency trading.

While the precise phishing kit or credential‑harvesting mechanisms remain unconfirmed due to the site’s offline status, the convergence of brand impersonation, crypto‑scam labeling, and multiple vendor detections provides strong evidence of a malicious intent. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies to include the observed IP range and SSL fingerprint, and monitor for any re‑registration attempts or similar sub‑domains that reuse the same infrastructure.