krekhin-logiin-us[.]godaddysites[.]com

The domain krekhin-logiin-us.godaddysites.com was observed hosting a credential‑collection page that mimics the Kraken cryptocurrency exchange. The page title returned by the web server is “Kraken Login | Buy, Sell and Margin Trade Bitcoin,” which directly references Kraken’s branding and service offering. The domain was registered on 18 November 2013 through GoDaddy.com, LLC and uses GoDaddy’s default nameservers (cns1.secureserver.net and cns2.secureserver.net). An SSL certificate issued by Go Daddy Secure Certificate Authority – G2 is present, matching the registrar but providing no indication of legitimate ownership. Network analysis shows the domain resolves to the IP address 13.248.243.5, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States.

The HTTP response for the root URL is a 404 status, suggesting the malicious landing page may have been removed or is served only on specific paths. VirusTotal has recorded 11 detections out of 95 scanned engines, confirming that multiple security vendors consider the host malicious. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. The infrastructure suggests a classic brand‑impersonation campaign targeting Kraken users, likely intended to harvest login credentials for crypto‑related fraud.

While the presence of a valid SSL certificate and a registered domain may increase user trust, the underlying host resides on a cloud provider commonly abused for short‑lived malicious sites. No additional evidence such as phishing kit identifiers or payload hashes has been released, leaving the exact operational timeline and the extent of victim exposure uncertain. Defenders should add the domain and its resolving IP to URL filtering and intrusion‑prevention policies, monitor for outbound connections to the IP address, and enforce multi‑factor authentication for Kraken accounts.