krranoiulogg[.]webflow[.]io

Analysis as of July 25 2026 indicates that the domain krranoiulogg.webflow.io is being used for a high‑risk brand‑impersonation campaign targeting Kraken users. The site’s page title “KraꝂeŋ® L𝗼𝗴@I𝒏 – Logging In | Empowering Traders” explicitly references Kraken and includes Unicode homographs, a common tactic to evade simple string matching. The domain resolves to 172.64.151.8, an address owned by AS13335 Cloudflare, Inc., and the DNS records point to Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS connection despite the malicious intent. VirusTotal records show that 13 of 95 scanned security vendors have flagged the domain, and Google Safe Browsing classifies the URL as a social‑engineering threat.

Independent blocklists, including PhishDestroy, have added the domain to their deny lists, and it appears on at least one additional public blocklist. The HTTP response currently returns 404, and the site is reported as taken offline, which may indicate a temporary takedown or a shift in infrastructure. The registrar listed is MarkMonitor, Inc., a service often used by legitimate enterprises, suggesting that the attacker may have compromised or sub‑registered a domain through a reputable registrar to increase credibility. The domain creation date of May 08 2013 predates the observed activity, implying that the attacker is leveraging an older, possibly previously unused registration.

Uncertainty remains regarding the exact content served before the 404 response, as no visual or form details are available in the current data set. Investigators should continue monitoring the IP address and associated Cloudflare accounts for re‑activation, and they should add the domain and its IP to internal blocklists and threat‑intel feeds.