krakinnloggin[.]webflow[.]io

This domain, krakinnloggin.webflow.io, is identified as a high-risk brand impersonation phishing resource targeting users of the Kraken cryptocurrency exchange platform. The page title, 'Kraken® Login - Log In to My - Account (official Website),' explicitly mimics the legitimate Kraken login portal, employing official branding elements to deceive victims into submitting credentials or sensitive financial information. No direct evidence of a cryptocurrency drainer kit was observed in initial analysis, though the domain structure and hosting pattern align with known credential-harvesting infrastructure commonly used in financial fraud campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc., a registrar frequently utilized in phishing operations due to its accessibility and low-cost domain services. The domain resolves to the IP address 172.64.151.8, geolocated within the United States and associated with AS13335, a network operated by a major content delivery and security provider. At the time of assessment, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while three independent security blocklists have listed it as a confirmed threat. The SSL certificate, issued by Google Trust Services under the WE1 intermediate, provides Transport Layer Security but does not mitigate the underlying phishing risk. Google Safe Browsing currently designates the domain as unsafe for user access. As of the latest verification, krakinnloggin.webflow.io has been taken offline, likely following automated or manual takedown procedures initiated by hosting providers or security response teams. Despite its inactive status, residual risk persists due to potential cached DNS records, browser history entries, or secondary distribution channels such as phishing emails or malicious advertisements. Organizations and end-users are advised to implement strict access controls, including domain-based blocking at the network perimeter and endpoint protection rules. Continuous monitoring for related domains registered under similar naming conventions or infrastructure is recommended to preempt further impersonation attempts.