krekcnlogin[.]webflow[.]io

This domain, krekcnlogin.webflow.io, poses a high-risk brand impersonation threat specifically targeting Kraken, a major cryptocurrency exchange. The site replicates Kraken’s login interface, including the page title 'Kraken | Buy, Sell and Margin Trade Bitcoin (BTC) and,' to deceive users into entering credentials. Successful compromise could lead to unauthorized access to cryptocurrency wallets, financial theft, or further exploitation via stolen session tokens. The primary objective appears to be credential harvesting, with potential secondary risks including crypto drainer deployment or account takeover for fraudulent transactions. Analysis indicates this domain is flagged by 13 out of 95 security vendors on VirusTotal, confirming its malicious nature. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., a registrar commonly used for legitimate domains, which may have contributed to its initial evasion of detection. The domain was created on May 08, 2013, though the subdomain krekcnlogin.webflow.io appears to have been recently repurposed for malicious activity. It resolves to the IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335), and is currently blocked by at least one security blocklist, including PhishDestroy. The SSL certificate is issued by Google Trust Services, adding a veneer of legitimacy to the fraudulent site. Users who visited krekcnlogin.webflow.io should assume their credentials may have been compromised. Immediate actions include revoking active sessions on the legitimate Kraken platform, enabling multi-factor authentication if not already active, and monitoring accounts for unauthorized transactions. If credentials were entered, users should change passwords for all associated accounts, particularly those linked to cryptocurrency services. Additionally, review connected devices and applications for suspicious activity, and consider freezing or transferring assets to a new wallet if signs of compromise are detected. Network-level indicators, such as the domain and IP 172.64.151.8, should be added to blocklists to prevent further exposure.