krakeanlogene[.]webflow[.]io

On July 24, 2026, the domain krakeanlogene.webflow.io was analyzed as a high‑risk brand‑impersonation campaign targeting Kraken. The site was registered through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services, but the domain itself was created on May 08, 2013, indicating long‑standing ownership that predates the observed malicious activity. Technical inspection shows the domain resolves to IP address 104.18.36.248, part of AS13335 Cloudflare, Inc., and is served via Cloudflare’s infrastructure with HTTP/3 enabled. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, confirming a valid certificate chain but offering no guarantee of legitimacy.

An HTTP request returns a 404 status, suggesting the malicious page is no longer publicly reachable; the current status is listed as offline. The page title captured during the brief availability period reads “Kraken®𝐋🅞𝒈 𝐈𝙣 | 𝑺î𝗴𝒏 i𝒏 |”, which directly references the Kraken brand and mimics a login interface, consistent with the reported crypto‑scam classification. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has added it to its blocklist, marking one confirmed security blocklist entry.

VirusTotal analysis recorded 15 detections out of 93 scanned security vendors, reinforcing the malicious assessment. While the offline state limits further content analysis, the combination of brand impersonation, a convincing page title, and multiple vendor detections indicates a purposeful attempt to harvest Kraken credentials. Defenders should ensure the domain is blocked at network and endpoint layers, monitor for any re‑hosting attempts on alternative infrastructure, and consider sharing the indicator set—including the domain, IP, and associated nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com)—with threat‑intelligence platforms to aid broader detection efforts.