kreknlugin[.]godaddysites[.]com

This domain, kreknlugin.godaddysites.com, is flagged as a generic_phishing site designed to mimic the Kraken cryptocurrency exchange login interface. The page title, 'Kr𝖆ken Loℊin | Loℊ In on Strikingly,' employs Unicode character substitution (e.g., 𝖆, ℊ) to evade basic text-based detection mechanisms. No specific drainer kit signatures were identified, but the domain leverages homoglyph techniques to deceive users into entering credentials, likely targeting cryptocurrency holders. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) infrastructure in the US. It was registered via GoDaddy.com, LLC on November 18, 2013, and uses a GoDaddy-issued SSL certificate (Go Daddy Secure Certificate Authority - G2). VirusTotal reports 22/95 security vendors flagging this domain as malicious. The domain appears on two security blocklists and was previously blocked by PhishDestroy and PhishingDB. No Google Safe Browsing (GSB) entries were confirmed at the time of analysis. As of the latest assessment, kreknlugin.godaddysites.com has been taken offline, reducing immediate exposure risk. However, the domain's historical registration and SSL infrastructure remain intact, posing a residual threat if reactivated. Organizations are advised to monitor for homoglyph-based phishing attempts targeting cryptocurrency platforms and update blocklists to include this domain and its associated IP. Users should verify domain authenticity before entering credentials, particularly for financial or cryptocurrency services.