sslvpn[.]krakenmedia[.]com

PhishDestroy has identified the domain sslvpn.krakenmedia.com as a brand impersonation phishing threat targeting the cryptocurrency exchange Kraken. This domain, with the seed 77e1b0, was configured to mimic Kraken's VPN login interface in an attempt to steal user credentials. No specific drainer kit was identified, but the impersonation of a trusted financial brand elevates the risk to users.

Technical analysis reveals that this domain has an elevated risk profile, with 11 out of 95 security vendors on VirusTotal flagging it as malicious. The domain was registered on December 7, 2005, through Dynadot LLC, and resolves to IP address 3.233.30.191, which is hosted on Amazon Web Services. It does not have an SSL certificate and appears on one security blocklist. Google Safe Browsing status is not listed, but the domain's age and registration suggest it may have been repurposed for malicious activity.

The current status of sslvpn.krakenmedia.com is offline, and it has been taken down following detection. However, the page title found was 'KrakenMedia.com for sale', indicating potential domain parking or reuse. Remaining risk is moderate, as similar domains may reappear. Users are advised to always verify URLs directly on official brand websites and to report any suspicious sites to PhishDestroy for analysis. PhishDestroy recommends avoiding clicking on links in unsolicited messages and ensuring SSL certificates are present before entering credentials.