krakennlogginn[.]webflow[.]io

This domain is flagged as a high-risk brand_impersonation threat targeting Kraken, a major cryptocurrency exchange platform. The site was designed to deceive users into disclosing login credentials, API keys, or other sensitive authentication details by mimicking the legitimate Kraken interface. Analysis indicates a deliberate attempt to exploit trust in the Kraken brand for financial fraud or unauthorized account access. Infrastructure analysis reveals the domain krakennlogginn.webflow.io was registered on May 8, 2013, through MarkMonitor, Inc., though recent malicious activity suggests potential compromise or repurposing. The domain resolves to IP address 104.18.36.248, hosted on Cloudflare infrastructure (AS13335) in the United States. Security vendors on VirusTotal flagged this domain as malicious, with 11 out of 95 detections confirming phishing-related activity. The domain appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the underlying threat. The current status shows the page as offline with a 404 error, likely due to takedown or suspension. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address across all network security controls. Organizations should deploy email and web filtering rules to prevent user access to the domain and monitor for related subdomains or typosquatting variants. End users should be educated on verifying legitimate Kraken domains (e.g., kraken.com) and enabling multi-factor authentication to reduce credential theft risks. Security teams should review logs for any prior connections to this domain and investigate potential account compromises. If credentials were entered on this site, immediate password resets and API key revocations are recommended for affected accounts.