kkrakkennallogin[.]webflow[.]io

On July 24, 2026, analysis of the domain kkrakkennallogin.webflow.io was performed. The site is hosted on Cloudflare, using the nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com and resolves to the IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS endpoint. HTTP probing returned a 404 status code, suggesting that the landing page is no longer accessible. The page title previously observed is “Kraken Login: Crypto Exchange | Buy crypto with peace of mind”, which directly references the Kraken brand and aligns with the reported brand impersonation and crypto‑scam classification.

Registration information shows the domain was created on May 08, 2013 and was registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may have been leveraged to lend credibility. Threat intelligence feeds have flagged the domain on at least one security blocklist and it is listed as blocked by PhishDestroy. VirusTotal scans reported 12 detections out of 95 security vendors, confirming that multiple detection engines consider the domain malicious. The infrastructure also exhibits HTTP/3 support, a feature often observed in contemporary phishing kits. No additional public analysis of the page content is available, and the current offline status prevents direct verification of the phishing payload.

Given the observed evidence, defenders should continue to block the domain at network perimeter devices and update URL filtering policies to include both the exact hostname and its resolved IP address. Monitoring of the associated Cloudflare IP range for any new phishing deployments is advised, as the same hosting infrastructure is frequently reused. Organizations that use Kraken services should educate users about the legitimate Kraken login URLs and encourage verification of TLS certificate details.