kruakenlogin[.]wordpress[.]com

This report details a malicious domain impersonating the legitimate Kraken cryptocurrency exchange. The site, with the page title "Ķŕákeń Ĺǒgiń: Áccess Yǒur Ṫradińg Áccǒunt Ꝗuickly," is categorized as a Fake Exchange scam. The primary threat is credential theft, as the site is designed to deceive users into entering their Kraken trading account login details, which would then be captured by the attacker.

Technical analysis confirms the malicious nature of the site. VirusTotal reports 9 out of 95 security vendors flagged the domain as malicious. Google Safe Browsing has flagged the site for "SOCIAL_ENGINEERING." The domain is registered with MarkMonitor, Inc., and was created on 2000-03-03. It resolves to IP address 192.0.78.12, hosted in the United States on AS2635 (Automattic, Inc.). The SSL certificate is issued by Let's Encrypt with fingerprint E8. The domain uses nameservers ns1.wordpress.com through ns4.wordpress.com.

The site is currently offline and inaccessible. Despite its inactive status, the risk level remains high due to its clear impersonation of a trusted brand and its history of being flagged for social engineering. Users who may have accessed the site while it was active should consider their Kraken credentials compromised and take immediate action to secure their accounts.