krakanlaginn[.]webflow[.]io

This domain krakanlaginn.webflow.io is currently offline, returning HTTP 404. The site was hosted behind Cloudflare, with HTTP/3 enabled, and resolved to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. located in the United States. Registration data shows the domain was created on May 08, 2013 and is managed by MarkMonitor, Inc., using the Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The TLS certificate presented by the service is issued by Google Trust Services under the WE1 label, indicating a valid HTTPS connection at the time of observation.

Google Safe Browsing classified the URL as a social engineering threat, and the domain appears on a single security blocklist, specifically flagged by PhishDestroy. VirusTotal analysis recorded 15 of 95 security vendors marking the domain as malicious, reinforcing the suspicion of a phishing campaign. The page title retrieved from the site read “Kraken Login : Cryptocurrency & Bitcoin,” and the intelligence tags identify the scam type as a crypto scam impersonating the Kraken brand. While the HTTP response code and title suggest an attempt to lure victims into credential harvesting for Kraken, the actual page content could not be captured because the site returned a 404 error.

Consequently, the precise tactics, form fields, or redirects remain unknown. Defenders should continue to block the domain at network perimeter, update URL filtering rules, and monitor for any resurgence of the host. Given the association with a recognized financial brand and the presence of multiple vendor detections, the risk rating remains high. Ongoing observation of the IP address and related Cloudflare infrastructure is advised in case the operator re‑hosts the phishing page on a different subdomain.