krrakenl0gin[.]wordpress[.]com

The subdomain krrakenl0gin.wordpress.com is flagged as a high‑risk brand‑impersonation site targeting Kraken users. Infrastructure analysis shows the domain resolves to 192.0.78.12, an IP owned by AS2635 Automattic, Inc. and located in the United States. The host runs a typical WordPress stack with Nginx, PHP, MySQL, HSTS, and HTTP/3, and the TLS certificate is issued by Let’s Encrypt (E8). The site returned HTTP status 410, indicating the content has been removed, and it is currently listed as offline.

Detection signals include 13 of 95 VirusTotal scanners flagging the domain, a Google Safe Browsing classification for social engineering, and inclusion on a single security blocklist. PhishDestroy has taken the site down, and the registrar information confirms registration through MarkMonitor, Inc., a service commonly used for brand protection. The page title "Kráken Login | Sign in to Kráken Account | Buy and Sell Bitcoin" explicitly references the Kraken brand, reinforcing the impersonation intent. While the domain itself is a WordPress subdomain and thus inherits the platform’s reputation, the combination of brand‑specific page title, multiple vendor detections, and safe‑browsing flag demonstrates a clear malicious purpose.

Uncertainty remains regarding the original payload or credential‑harvesting mechanisms, as the site is no longer serving content. Defenders should continue to block the subdomain at network perimeter and DNS layers, update internal threat‑intel feeds with the observed indicators, and educate users about the fraudulent Kraken login page referenced in the title. Ongoing monitoring of the parent wordpress.com namespace for similar subdomains is advised, as the platform can be leveraged for rapid deployment of impersonation pages.