sso--kraken-app-cdn[.]webflow[.]io

This domain, sso--kraken-app-cdn.webflow.io, poses a targeted brand impersonation threat against Kraken, a major cryptocurrency exchange. Analysis indicates the site was designed to deceive users into believing they were interacting with legitimate Kraken authentication infrastructure, likely aiming to harvest login credentials or deploy crypto-draining malware. The domain mimics Kraken’s single sign-on (SSO) workflow, a common tactic to exploit trust in established brands for credential theft or financial fraud. Evidence supporting this assessment includes detection by 13 out of 95 security vendors on VirusTotal, indicating moderate but consistent identification as malicious. The domain was registered through MarkMonitor, Inc. on May 8, 2013, though the phishing content appears to have been hosted recently, leveraging Cloudflare’s infrastructure (AS13335) with an IPv6 address of 2606:4700:440c::ac40:9708. It appears on at least one security blocklist, and the SSL certificate issued by Google Trust Services (WE1) further suggests an attempt to appear legitimate. The current 404 status confirms the site has been taken offline, though residual risk remains for users who may have interacted with it prior to removal. Users who visited sso--kraken-app-cdn.webflow.io should immediately revoke any active sessions on Kraken and other cryptocurrency platforms. Credentials entered on the site must be considered compromised and changed across all services where reused. Enable multi-factor authentication (MFA) using hardware-based or app-based tokens, not SMS, to mitigate account takeover risks. Monitor financial transactions for unauthorized activity and report any suspicious behavior to the targeted brand’s security team. If crypto-draining malware was potentially downloaded, isolate the affected device, perform a full antivirus scan, and consider a clean OS reinstall. Retain logs or screenshots of interactions with the domain for potential incident response.