krakinuuloggen[.]webflow[.]io

This domain is flagged as a high-risk brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the site operates as a fake login portal, designed to harvest user credentials and facilitate unauthorized account access. The threat type aligns with credential theft tactics commonly employed in cryptocurrency-related phishing campaigns, where attackers exploit brand trust to deceive victims. Infrastructure analysis reveals the domain krakinuuloggen.webflow.io was registered through NameCheap, Inc. on February 21, 2026, and resolves to the IP address 172.64.151.8, associated with Cloudflare, Inc. (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often leveraged to lend false credibility. Detection metrics show 18 out of 95 security vendors on VirusTotal flag the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its malicious classification. The page title, 'Kraken® Login - Log In to My - Account (official Website),' employs branding elements to mimic authenticity, a hallmark of brand impersonation schemes. Mitigation measures for this threat type include immediate domain blocking at the network level, particularly for endpoints resolving to 172.64.151.8. Organizations should update security policies to flag domains registered through NameCheap with creation dates matching the campaign timeline (February 2026) and exhibiting similar SSL certificate patterns. End-users are advised to verify domain authenticity by cross-referencing official communication channels and avoiding interaction with unsolicited login portals. Multi-factor authentication (MFA) should be enforced for all cryptocurrency exchange accounts to mitigate credential theft risks, even if credentials are compromised. Security teams are encouraged to monitor for additional domains leveraging the same registrar, IP range, or SSL certificate authority to preemptively disrupt related campaigns.