krrakenloginsx[.]webflow[.]io

The domain krrakenloginsx.webflow.io has been identified as a high-risk brand impersonation site targeting the cryptocurrency exchange Kraken. The domain is designed to deceive users by mimicking the official Kraken login page, potentially leading to credential theft and financial loss.

Infrastructure analysis reveals that krrakenloginsx.webflow.io is flagged by 13 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The domain is registered through MarkMonitor, Inc., and resolves to the IP address 104.18.36.248, which is located in the United States and is part of Cloudflare, Inc.'s network (AS13335). The SSL certificate is issued by Google Trust Services / WE1. The domain was created on May 08, 2013. Google Safe Browsing has also flagged this domain as a phishing site, and it appears on 1 security blocklist, specifically PhishDestroy.

Although the domain is currently offline, the potential for it to be reactivated remains. Immediate response actions should include blacklisting this domain in security systems and warning users to avoid visiting any similar-looking domains. Additionally, users should verify the URL of the official Kraken website before entering any credentials to prevent falling victim to such impersonation attacks. The remaining risk is moderate, as the domain can be re-purposed for further phishing activities if not continuously monitored.