crakanlogiin[.]webflow[.]io

The domain crakanlogiin.webflow.io is identified as a high-risk phishing resource specializing in brand impersonation. This domain specifically targets users of the Kraken cryptocurrency exchange, presenting a fraudulent login interface under the page title 'Kraken Login | Buy, Sell and Margin Trade Bitcoin.' As of the latest analysis, the domain has been taken offline, though prior activity indicates a deliberate attempt to harvest user credentials and sensitive financial information. Analysis of technical indicators reveals multiple red flags. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with detection engines classifying it as malicious. It appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on May 8, 2013, though the subdomain crakanlogiin.webflow.io was likely created more recently for malicious purposes. The domain resolves to the IP address 172.64.151.8, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services under the identifier WE1, a common practice among phishing operators to lend an appearance of legitimacy. Google Safe Browsing has also flagged this domain as a phishing threat, further corroborating its malicious intent. At present, crakanlogiin.webflow.io is offline, reducing immediate risk to end users. However, the infrastructure and registration patterns suggest potential for reactivation or migration to alternative domains. Organizations and individuals are advised to block the domain and its associated IP address (172.64.151.8) at the network level. Users should verify the authenticity of any login portal by cross-referencing the URL with official exchange documentation. Security teams are encouraged to monitor for similar subdomains under the webflow.io parent domain, as this hosting platform is frequently abused for phishing campaigns. Continuous vigilance and real-time threat intelligence sharing are recommended to mitigate future iterations of this threat.