krkrnin-lgn[.]webflow[.]io

This domain, krkrnin-lgn.webflow.io, is flagged as a high-risk brand impersonation phishing site targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the official Kraken interface, using the page title 'Kraken Crypto Exchange | Buy crypto with peace of mind' to deceive users into entering credentials or financial details. No specific drainer kit signatures were identified in initial scans, but the domain exhibits characteristics consistent with credential harvesting infrastructure commonly used in cryptocurrency phishing campaigns.

Technical indicators confirm the domain was registered through Webflow and resolves to the IP address 104.18.36.248, hosted on infrastructure associated with Cloudflare, Inc. in Canada. The domain was created on March 22, 2026, and has been flagged by 19 out of 95 security vendors on VirusTotal. It appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. Google Safe Browsing (GSB) status was not explicitly provided, but the domain's inclusion in multiple blocklists suggests it was likely classified as malicious by GSB during its active period.

As of the latest assessment, krkrnin-lgn.webflow.io has been taken offline, reducing immediate risk to end users. However, the infrastructure used (Webflow and Cloudflare) remains accessible for potential reuse in future campaigns. Users who may have interacted with this domain are advised to rotate credentials immediately, enable multi-factor authentication on all financial and cryptocurrency accounts, and monitor for unauthorized transactions. Organizations should update internal blocklists to include this domain and its associated IP to prevent future access attempts.