loginkarkenn[.]webflow[.]io

Analysis of the domain loginkarkenn.webflow.io indicates a high-risk brand impersonation campaign targeting Kraken, a cryptocurrency exchange. The domain, hosted on Cloudflare infrastructure (IP 104.18.36.248, AS13335), was flagged for social engineering by Google Safe Browsing and appears on one security blocklist. The page title, 'Kraken® Login - Log_In to My - Account (official Website)', explicitly impersonates the Kraken brand, aligning with the classified scam type of crypto fraud. Detection data from VirusTotal shows 13 of 95 security vendors marked the domain as malicious, though the exact detection timeline is not specified.

Infrastructure analysis reveals the domain was created on May 8, 2013, and registered through MarkMonitor, Inc., with Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), and the site previously supported HTTP/3. As of the report date, the domain returns an HTTP 404 status, suggesting it has been taken offline, though residual detection alerts may persist. The registrar and hosting provider are consistent with legitimate services, which attackers often exploit to evade immediate suspicion.

Defenders should note that while the domain is no longer active, the underlying infrastructure (Cloudflare, MarkMonitor) may be reused for future campaigns. The presence of 13 detections on VirusTotal, combined with Safe Browsing’s social engineering flag, underscores the need for continued monitoring of similar subdomains under webflow.io or other platform-as-a-service providers. No evidence links this domain to broader phishing kits or actor groups, and the exact content of the phishing page remains unanalyzed. Organizations should verify blocklist coverage for this domain and audit logs for prior access attempts, particularly from users in regions where Kraken is a known target.