krakenlive[.]blogspot[.]com

Analysis of krakenlive.blogspot.com, observed on July 24, 2026, indicates that the site is being used for brand impersonation targeting Kraken users. The domain resolves to the IPv6 address 2a00:1450:4001:811::2001, which is advertised as belonging to AS15169 owned by Google LLC and geolocated to Germany. DNS resolution is provided by Google’s authoritative name servers ns1.google.com through ns4.google.com, and the TLS certificate is issued by Google Trust Services under the WE2 profile, confirming the use of Google infrastructure. The page returns an HTTP 404 status with the title "No se ha encontrado el blog.", suggesting the content is deliberately unavailable or removed, consistent with the reported offline status.

The site is identified as employing Blogger, Java, Python, OpenGSE, and HTTP/3 technologies, all typical of a blog‑hosted environment rather than a bespoke phishing landing page. Nonetheless, Google Safe Browsing classifies the URL as a social engineering threat, and PhishDestroy has actively blocked it. VirusTotal reports eight of ninety‑five scanned security vendors flagging the domain as malicious, and it appears on a single external blocklist. Registration details show the domain was created on July 31, 2000 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may be an attempt to lend credibility.

The threat is categorized as a crypto scam, specifically impersonating Kraken to lure victims into credential harvesting or financial loss. Defenders should continue to block the domain at network perimeter controls, update endpoint filters to include the reported blocklist entry, and monitor for any resurgence of the site under related subdomains or alternate hosting. Given the Google‑hosted infrastructure, rapid takedown requests to the hosting provider may be effective if the site reappears.