kerrannlogin[.]wordpress[.]com

The domain kerrannlogin.wordpress.com was observed serving a page whose title reads “Kraken Login: Bitcoin, Cryptocurrency Exchange – kraken login”, indicating an attempt to mimic the legitimate Kraken cryptocurrency exchange. The site is hosted on WordPress.com infrastructure, as evidenced by the nameservers ns1‑ns4.wordpress.com and the technology stack (WordPress, MySQL, PHP, Nginx, HSTS, HTTP/3). DNS resolution points to IP 192.0.78.12, which belongs to AS2635 Automattic, Inc., a US‑based provider. The domain was registered on March 03, 2000 through MarkMonitor, Inc., a registrar commonly used for legitimate brand assets, suggesting possible abuse of a long‑standing domain rather than a freshly registered look‑alike.

Security telemetry shows mixed detection: Google Safe Browsing flags the URL for social engineering, and nine of ninety‑five VirusTotal scanners raise alerts, placing the site on at least one public blocklist (PhishDestroy). The site presents a valid TLS certificate issued by Let’s Encrypt (E8), but the certificate does not mitigate the underlying impersonation risk. An HTTP 410 response indicates the content has been removed, and the domain is currently offline, yet the artifacts remain indexed by security feeds. Analysts can confirm the impersonation intent from the page title and the explicit “Impersonates: Kraken” tag.

However, the exact phishing kit or credential‑harvesting mechanisms have not been disclosed, and no visual capture of the page is available. Defenders should continue to block the domain at perimeter filters, monitor the associated IP range for any re‑activation, and update brand‑specific threat intel for Kraken to include this indicator. Users should be warned that any unsolicited communication directing them to a “kraken login” page on a wordpress.com subdomain is likely malicious. Ongoing observation of the registrar’s abuse channels is recommended to ensure rapid takedown if the site resurfaces.