ktreinkenslogi[.]webflow[.]io

On July 23, 2026 analysts observed the domain ktreinkenslogi.webflow.io hosting a page titled “Kraken® Login® - Log_In to My - Account (official* Website)”. The page title explicitly references the Kraken brand, indicating a brand‑impersonation attempt. The site resolves to IP 104.18.36.248, which belongs to Cloudflare (AS13335) and is located in the United States. The domain uses Cloudflare’s DNS service (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) and serves content over HTTP/3 with a TLS certificate issued by Google Trust Services under the WE1 hierarchy.

The certificate chain is legitimate, but the presence of a Cloudflare front‑end does not guarantee benign intent. VirusTotal analysis shows that 14 of 95 security scanners flagged the domain, and Google Safe Browsing classifies it as social‑engineering. The domain appears on a single public blocklist and has been added to the PhishDestroy blocklist, confirming its malicious reputation. Registration records list MarkMonitor, Inc. as the registrar, and the domain was created on 08 May 2013, suggesting the infrastructure may be reused for new campaigns.

HTTP requests return a 404 status, indicating the malicious page may no longer be hosted, and the current status is listed as offline. While the technical indicators confirm a high‑risk crypto‑scam targeting Kraken users, the exact payload, credential‑harvesting mechanisms, and phishing kit remain unverified because the page content has not been captured. Defenders should continue to block ktreinkenslogi.webflow.io at DNS and proxy layers, monitor for any resurgence of the domain, and update detection rules to flag the observed page title and the associated Cloudflare IP range. Additional telemetry from endpoint sensors should be collected to identify any attempted credential submission to this domain, and users of Kraken services should be reminded to verify URLs against the official Kraken domain.