secure-krakken-com[.]square[.]site

The domain secure-krakken-com.square.site is an active credential phishing site that poses a significant threat to users by attempting to steal login credentials. It does not impersonate a specific brand and does not use a drainer kit, but its current status is active, making it a direct risk for anyone who encounters it. This site is designed to trick visitors into entering sensitive information, such as usernames and passwords, under the guise of a legitimate service, and should be considered unsafe.

Technical analysis reveals that secure-krakken-com.square.site has been flagged by 2 of 95 VirusTotal vendors, including ChainPatrol and alphaMountain.ai, and appears on 1 security blocklist, specifically PhishDestroy. The domain was registered through MarkMonitor, Inc. on February 5, 2019, and resolves to IP address 74.115.51.4, located in the US and hosted by AS27647 Weebly, Inc. It uses an SSL certificate issued by Let's Encrypt / E7, and the page title observed is 'Just a moment...', with an HTTP status of 404. Technologies detected include Amazon Web Services and Cloudflare, and the nameservers are associated with AWS.

To protect against this credential phishing threat, users who have interacted with secure-krakken-com.square.site should immediately change any passwords entered on the site and enable two-factor authentication on all affected accounts. Monitor for unauthorized activity and report the phishing attempt to relevant authorities, such as the Anti-Phishing Working Group or your email provider. Additionally, report the domain to security blocklists like PhishDestroy to help prevent further victimization.