kraaknsllogi[.]webflow[.]io

This domain, kraaknsllogi.webflow.io, is currently flagged as a high‑risk impersonation of the cryptocurrency exchange Kraken. Infrastructure analysis shows the zone is delegated to the Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the DNS A record resolves to 172.64.151.8, an address owned by AS13335 Cloudflare, Inc. The service presents a TLS certificate issued by Google Trust Services under the common name WE1, which is a generic certificate used by Cloudflare’s edge network and therefore does not provide authentication of the originating entity. HTTP probing returned a 404 status code, and the site is listed as taken offline, indicating that the payload is no longer reachable at the time of assessment. The domain was created on 08 May 2013 and is registered through MarkMonitor, Inc., a registrar often used for brand‑protection purposes.

Despite the older registration date, the site actively targeted Kraken users, as evidenced by the page title “Kraken Login: Bitcoin, Cryptocurrency Exchange” and the classification of the scam as a Crypto Scam. Threat‑intelligence sources corroborate malicious intent: Google Safe Browsing flags the URL for social‑engineering, PhishDestroy has added it to its blocklist, and VirusTotal reports detections by 15 of 93 scanning engines. The domain also appears on an additional security blocklist, further confirming its reputation as a phishing or credential‑harvesting host.

Because the site is currently offline, content‑level analysis is unavailable, and the exact phishing kit or credential‑capture mechanism cannot be confirmed. However, the convergence of Cloudflare hosting, a generic TLS certificate, a brand‑targeted page title, and multiple independent detections creates a strong confidence level that the domain was used to lure Kraken customers into disclosing login credentials or cryptocurrency‑related information.