mykrakenlogins[.]webflow[.]io

This domain, mykrakenlogins.webflow.io, is flagged for brand impersonation targeting Kraken, a major cryptocurrency exchange. Analysis indicates the presence of a fraudulent login portal designed to harvest user credentials, likely for unauthorized account access or subsequent crypto asset theft. The page title, 'KRAKEN LOGIN - Get Verified On Kraken Exchange,' explicitly mimics the legitimate Kraken platform, reinforcing the deceptive intent. No direct evidence of a crypto drainer kit was observed, but the credential-harvesting mechanism aligns with common phishing tactics in the cryptocurrency sector.

Infrastructure analysis reveals multiple technical indicators of compromise. The domain is detected by 15 out of 95 security vendors on VirusTotal, with a registrar of record as MarkMonitor, Inc. It resolves to the IP address 172.64.151.8, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain was originally created on May 8, 2013, though the subdomain or malicious deployment appears to be a recent addition. It is currently blocked by one security blocklist and was previously flagged by Google Safe Browsing. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the fraudulent nature of the content.

As of the latest assessment, the domain has been taken offline, reducing immediate exposure to end users. However, the infrastructure remains registered, and the risk of redeployment persists. Users who may have interacted with the domain are advised to rotate credentials immediately, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated indicators, such as the IP address and registrar details, to prevent future access attempts.