kraakenlogin[.]webflow[.]io

The domain kraakenlogin.webflow.io is currently flagged as a brand‑impersonation site targeting Kraken users. Registration data shows the domain was created on May 08, 2013 and is listed under the MarkMonitor, Inc. registrar, a service often used for legitimate brand protection but also occasionally abused by threat actors. DNS resolution points to the IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain employs Cloudflare’s DNS service (journey.ns.cloudflare.com and lamar.ns.cloudflare.com) and serves its content over HTTP/3 with a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid, publicly trusted certificate.

A HTTP request to the site returned a 404 status code, and the site is presently taken offline, consistent with a temporary hosting strategy often used to evade detection. VirusTotal analysis recorded 15 detections out of 95 scanning engines, confirming that multiple security vendors recognize the domain as malicious. The site appears on one public security blocklist and has been actively blocked by PhishDestroy, further reinforcing its classification as a threat. The page title retrieved from the site, “Kraken Login - #1™Bitcoin & Cryptocurrency ®Exchange,” directly references the Kraken brand and aligns with the reported crypto‑scam motive.

While the exact phishing kit or credential‑harvesting mechanism remains unknown due to the site’s offline status, the combination of brand‑specific page title, crypto‑focused language, and multiple vendor detections provides sufficient confidence to label the domain as a high‑confidence impersonation vector. Defenders should continue to block the domain at network perimeter controls, update URL filtering lists, and monitor for any resurgence of the domain or associated C2 infrastructure.