karakueiuionloghin[.]gitbook[.]io

Analysis of karakueiuionloghin.gitbook.io, first observed as a brand‑impersonation site targeting Kraken, shows multiple indicators of malicious activity. The domain was registered on March 30 2014 through Cloudflare, Inc. and is currently hosted on Cloudflare’s network (AS13335) with the IP address 172.64.147.209 located in the United States. DNS resolution uses the Cloudflare nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, and the site serves traffic over HTTP/3 with a valid SSL certificate issued by Google Trust Services (WE1). An HTTP 307 redirect is returned for the root URL, and the page title “KraꝂeŋ® L𝗼𝗴@I𝒏 – Logging In | Empowering Traders – us” explicitly references the Kraken brand, confirming the impersonation intent.

Google Safe Browsing has flagged the domain for social engineering, and 16 of 93 VirusTotal scanners have identified it as malicious. The site is listed on a single public blocklist and has been blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigns a trust score of 1 / 100, indicating an extremely low confidence in legitimacy. The stated scam type is a “Crypto Scam,” consistent with the use of Kraken’s trademarked assets to lure cryptocurrency traders.

While the technical infrastructure (Cloudflare hosting, valid TLS, HTTP/3) is typical for legitimate services, the combination of brand‑specific page title, safe‑browsing warning, multiple vendor detections, low trust score, and blocklist presence points to a high‑risk phishing operation. The exact content of the landing page has not been publicly disclosed, so the specific credential‑stealing mechanisms remain uncertain. Defenders should block the domain at perimeter and DNS layers, monitor for outbound connections to the IP 172.64.147.209, and update intrusion‑detection signatures to include the observed page title and redirect behavior.