krekknnloftin[.]webflow[.]io

This domain, krekknnloftin.webflow.io, is flagged as a high-risk brand impersonation site targeting Kraken, a cryptocurrency exchange. Analysis indicates the domain was operational as a crypto scam, with a page title explicitly mimicking the legitimate Kraken platform: 'Kraken Crypto Exchange | Buy crypto with peace of mind.' The domain is currently offline, returning an HTTP 404 status, and is listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal detections show 14 of 94 security vendors marking the domain as malicious, reinforcing its classification as a threat. Infrastructure analysis reveals the domain was hosted on Webflow and resolved to IP 104.18.36.248, part of Cloudflare's network (AS13335).

The use of Cloudflare and HTTP/3 is consistent with modern phishing campaigns leveraging CDN services to obscure origin servers. No nameservers were detected, which may indicate recent takedown efforts or misconfiguration. The domain's registration details are tied to Webflow, a legitimate platform often abused for hosting fraudulent content due to its ease of deployment. Defenders should treat this domain as confirmed malicious based on its presence on multiple blocklists, vendor detections, and alignment with known crypto scam patterns.

While the domain is offline, historical resolution data (IP, ASN) should be incorporated into network-level blocking rules. Monitoring for re-registration or reuse of the same infrastructure (e.g., Webflow subdomains, Cloudflare IPs) is recommended. No additional evidence of payload delivery or victim interaction is available at this time, limiting further attribution.