krakennloginu[.]wordpress[.]com

Analysis conducted on July 25, 2026 identifies krakennloginu.wordpress.com as an offline phishing infrastructure targeting the cryptocurrency exchange Kraken. The site used the page title “Kraken Login – Bitcoin & Cryptocurrency Exchange”, directly referencing the brand. The domain is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, and the underlying hosting is provided by Automattic’s WordPress platform (AS2635, United States) with the IP address 192.0.78.13. Technical fingerprints show WordPress, MySQL, PHP, Nginx, HSTS and HTTP/3, and the SSL certificate is issued by Let’s Encrypt (E8).

The domain was created on March 03, 2000, long before the observed malicious activity, suggesting the attacker leveraged an existing dormant sub‑domain. Current HTTP status is 410, indicating the resource has been removed, and the domain is listed as taken offline by the blocklist provider PhishDestroy. It appears on one security blocklist and Google Safe Browsing flags it for social engineering. VirusTotal recorded detections from eight of ninety‑five scanners, reinforcing the malicious classification.

While the exact phishing kit or payload is not disclosed, the combination of brand impersonation, crypto‑related page title, and social‑engineering flag points to a crypto‑scam campaign. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation of the sub‑domain, and update threat‑intel feeds with the observed indicators: domain name, IP 192.0.78.13, SSL thumbprint, and associated blocklist entries. Additional investigation may focus on any recent traffic spikes before the 410 response to capture potential victim data exfiltration.