krakkenlogin[.]wordpress[.]com

The domain krakkenlogin.wordpress.com is a phishing site that impersonates the Kraken cryptocurrency exchange, posing a brand impersonation threat. It was designed to deceive users into entering login credentials or other sensitive information under the guise of the legitimate Kraken platform. No crypto drainer kit was detected. The site is currently taken offline, but it previously operated as a fake exchange scam.

Technical indicators show that krakkenlogin.wordpress.com was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and alphaMountain.ai. It appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through MarkMonitor, Inc. on March 03, 2000, and resolved to the IP address 192.0.78.12, hosted by Automattic, Inc. in the US. The SSL certificate was issued by Let's Encrypt / E8, and the observed page title contained obfuscated text mimicking Kraken's branding. The site used WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3 technologies. Nameservers were ns1.wordpress.com, ns2.wordpress.com, ns3.wordpress.com, and ns4.wordpress.com, and the HTTP status returned a 410 code.

Users who may have interacted with krakkenlogin.wordpress.com should immediately change their Kraken account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized transactions or login attempts. Report the phishing domain to Kraken's security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to help prevent further abuse.