krakenelfoin[.]godaddysites[.]com

Analysis indicates that krakenelfoin.godaddysites.com is an offline site that was previously serving a page titled “Kr𝖆ken Login |”. The title directly references the target brand, Kraken, and aligns with the classified crypto‑scam impersonation. The domain was created on 18 November 2013 and is registered through GoDaddy.com, LLC, using GoDaddy’s default nameservers cns1.secureserver.net and cns2.secureserver.net. DNS resolution points to 13.248.243.5, an Amazon Web Services address (AS16509) located in the United States.

The site presented a valid GoDaddy Secure Certificate Authority – G2 TLS certificate, confirming that the HTTPS handshake was correctly signed by the registrar’s CA. HTTP requests now return a 404 status, indicating that the content has been removed or the site taken offline. Despite the current unavailability, the domain has been flagged by multiple security vendors: 14 of 95 VirusTotal scanners reported malicious activity, and it is listed on at least one public blocklist. PhishDestroy has also added the domain to its blocklist, reinforcing its classification as a brand‑impersonation vector.

No additional forensic artifacts such as page screenshots or payload samples have been released, so the exact mechanics of the alleged crypto scam remain unconfirmed. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation of the host or associated IP, and update detection rules to match the observed page title pattern. Analysts are advised to correlate any future traffic to 13.248.243.5 with this indicator to catch potential resurgence. The combination of brand‑targeted title, validated SSL certificate, and multi‑vendor detections justifies an elevated risk rating.