kreikeunlgien[.]webflow[.]io

The domain kreikeunlgien.webflow.io was observed as a high‑risk brand‑impersonation site targeting the cryptocurrency exchange Kraken. The site is currently offline, returning HTTP 404 for its root URL, but historical evidence indicates the page title was set to “Kraken Login: Bitcoin & Cryptocurrency Exchange | Bitcoin Trading,” which aligns with a crypto‑scam classification. Technical inspection shows the domain resolves to 104.18.36.248, an IP address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain is served through Cloudflare’s infrastructure, uses HTTP/3, and presents a TLS certificate issued by Google Trust Services under the “WE1” designation, confirming a valid HTTPS configuration despite the impersonation intent.

Nameserver records point to journey.ns.cloudflare.com and lamar.ns.cloudflare.com, both Cloudflare‑controlled zones. Registration data reveal the domain was created on May 08 2013 and is listed under the registrar MarkMonitor, Inc., a provider commonly used for legitimate brand protection services, suggesting possible abuse of a legitimate account. VirusTotal analysis shows that 13 of 95 scanned security vendors flagged the domain, indicating moderate detection across the ecosystem. Google Safe Browsing classifies the site as “social engineering,” and the domain appears on one public security blocklist, with PhishDestroy confirming active blocking.

The evidence collectively confirms a credential‑harvesting attempt that exploits Kraken’s brand reputation to lure cryptocurrency users. Because the live content is no longer reachable, specific details about the login form or payload cannot be verified. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host under the same IP or nameserver set, and apply brand‑specific alerts for Kraken‑related phishing attempts.