en-us-krraken[.]wixstudio[.]com

PhishDestroy identifies en-us-krraken.wixstudio.com as an active generic phishing domain hosting a fake login page designed to impersonate the Kraken cryptocurrency exchange. The threat type is generic_phishing with a crypto drainer kit implied by the impersonation of a major exchange. This WixStudio-hosted subdomain is part of a suspected credential harvesting campaign targeting crypto users through spoofed login interfaces.

This domain resolves to IP address 34.144.206.118 and is protected by a Let’s Encrypt SSL certificate. It currently shows 6/95 detections on VirusTotal and is flagged on 2 security blocklists, while being actively blocked by SEAL and MetaMask. The domain is registered under Wix.com and was created as part of a likely automated campaign aimed at mimicking official Kraken domains via the en-us- prefix pattern. Google Safe Browsing (GSB) status remains unverified, leaving users potentially exposed through organic or referral traffic.

The domain remains active and under investigation with a status of ‘active’ and a current risk level of ‘under_investigation’. PhishDestroy continues to monitor this domain while advising users to avoid entering any credentials or sensitive data. Remaining risk includes potential further development into a crypto drainer or expansion into broader phishing campaigns. Users are urged to verify any unfamiliar domains via PhishDestroy’s real-time threat feed before interaction.