kirncrakenlogiusa[.]webflow[.]io

This domain, kirncrakenlogiusa.webflow.io, operates as a credential phishing site targeting users of the Kraken cryptocurrency exchange. The page mimics the official Kraken login interface, presenting a fraudulent login portal titled 'Kraken® Login | Buy, Sell and Margin Trade Bitcoin (BTC) and Ethereum.' The intent is to deceive users into submitting their account credentials, enabling unauthorized access to their cryptocurrency holdings and personal financial data. The site employs realistic branding and design elements to enhance credibility, increasing the likelihood of successful compromise for unsuspecting victims.

Analysis of the domain infrastructure reveals multiple indicators of malicious activity. The domain is registered through NameCheap, Inc., and was created on February 22, 2026, though the discrepancy in the creation date suggests potential manipulation or a placeholder entry. It resolves to the IP address 104.18.36.248, hosted on AS13335 (Cloudflare, Inc.), a common tactic to obscure the true origin of the phishing server. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by Google Safe Browsing as phishing. VirusTotal reports that 19 out of 95 security vendors detect this domain as malicious, further corroborating its fraudulent nature. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is frequently exploited by threat actors to lend an appearance of authenticity to phishing sites.

Users who have visited kirncrakenlogiusa.webflow.io or entered credentials on the site should take immediate action to mitigate potential compromise. First, any credentials submitted should be considered exposed and must be changed immediately on the legitimate Kraken platform. Multi-factor authentication (MFA) should be enabled if not already active, using an authenticator app or hardware token rather than SMS-based methods. Affected users should monitor their Kraken accounts for unauthorized transactions and report any suspicious activity to Kraken’s security team. Additionally, devices used to access the phishing site should be scanned for malware, as some phishing campaigns deploy secondary payloads to maintain persistence or harvest additional data. If financial losses are suspected, users should contact their local cybercrime reporting authority to file a formal complaint.