krrakinlogin[.]wordpress[.]com

Analysis of krrakinlogin.wordpress.com indicates a credential phishing domain targeting users through a deceptive login page titled 'Kráken Logín.' The domain, hosted on WordPress infrastructure, resolves to IP 192.0.78.13 (AS2635 Automattic, Inc., US) and is currently offline with an HTTP 410 status. Registration details show it was created on March 03, 2000, and managed by registrar MarkMonitor, Inc., though the creation date may reflect domain squatting or a re-registration event rather than active use since 2000. The SSL certificate is issued by Let's Encrypt (serial E8), and the domain appears on one security blocklist, with Google Safe Browsing flagging it for social engineering. Detection engines on VirusTotal report 9 of 93 vendors marking it as malicious, while PhishDestroy has blocked access.

Nameservers (ns1-4.wordpress.com) and technologies (WordPress, MySQL, PHP, Nginx, HSTS, HTTP/3) align with standard WordPress hosting, suggesting the threat actor leveraged a legitimate platform to deploy the phishing page. Defenders should note that the domain's current offline status does not eliminate risk, as it may be reactivated or replaced with similar infrastructure. The page title explicitly references 'Kráken,' implying a potential focus on cryptocurrency users, though no further evidence confirms the exact target brand or phishing kit used. The HTTP 410 response indicates the hosting provider or WordPress may have intervened, but historical DNS and SSL data should be reviewed for prior activity.

Blocklist monitoring, Safe Browsing alerts, and vendor detections provide actionable indicators for network-level blocking. Given the use of WordPress hosting, defenders should also audit for other subdomains or similarly named domains under wordpress.com that may follow the same pattern. No evidence links this domain to broader campaigns, but the combination of social engineering flags and credential phishing classification warrants continued scrutiny.