krakenlogin[.]weebly[.]com

This domain is flagged as a high-risk credential theft operation targeting Kraken users. Analysis indicates the site was designed to harvest login credentials for the Kraken cryptocurrency exchange, enabling unauthorized access to user accounts and potential financial theft. The specific threat type is brand impersonation with credential theft objectives, not merely generic phishing or crypto draining activity. Infrastructure analysis reveals the following technical indicators: 11 out of 95 security vendors on VirusTotal flag the domain as malicious. The domain was registered through Safenames Ltd on March 29, 2006, though the phishing content appears to have been hosted more recently. It resolves to IP address 74.115.51.9, located in the US under AS27647 (Weebly, Inc.). The site uses a Let's Encrypt SSL certificate (E8) and presents a page title mimicking the legitimate Kraken platform: Kraken Login - Bitcoin & Cryptocurrency Exchange | Buy, Sell And Margin. - Home. The domain appears on one security blocklist and is specifically blocked by PhishDestroy. Google Safe Browsing also classifies this as a phishing site. Mitigation for this credential theft threat requires immediate action from both users and security teams. Users who may have interacted with krakenlogin.weebly.com should reset their Kraken account passwords using multi-factor authentication and review account activity for unauthorized transactions. Security teams should add the domain and its resolving IP (74.115.51.9) to web filtering rules and endpoint protection blocklists. Organizations should also monitor for credential reuse across other platforms, as stolen Kraken credentials may be tested against additional services. Given the domain's current offline status, security teams should investigate whether this represents a takedown or a temporary pause in operations, as threat actors may reactivate similar infrastructure under different domains.