kraken-l0gin[.]webflow[.]io

The domain kraken-l0gin.webflow.io is flagged as a high‑risk brand‑impersonation site targeting the cryptocurrency exchange Kraken. Infrastructure analysis shows the domain is hosted behind Cloudflare, utilizing HTTP/3, and resolves to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming the Cloudflare hosting layer. The site presented a page title of "Kraken Login | Bitcoin & Cryptocurrency Exchange," directly mirroring Kraken’s branding, and was classified as a crypto‑scam in the intelligence feed. The SSL certificate is issued by Google Trust Services under the WE1 certificate profile, indicating a valid HTTPS connection at the time of observation.

Google Safe Browsing identified the domain as a social‑engineering threat, and the site was listed on a single security blocklist. PhishDestroy has actively blocked the domain, and it appears on one additional blocklist, reinforcing its malicious status. VirusTotal scans recorded 14 detections out of 95 security vendors, providing further corroboration of malicious activity. The domain was registered on May 08 2013 through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services, suggesting the registration may have been subverted or leveraged for malicious purposes.

Current HTTP response is a 404 status, and the domain is reported as taken offline, which may be the result of takedown actions or temporary hosting changes. However, the historical evidence of brand impersonation, SSL provisioning, and multiple vendor detections indicates a persistent threat vector that could be re‑activated if the infrastructure is restored. Defenders should continue to block the domain at perimeter security controls, monitor DNS queries for the associated IP and nameserver patterns, and update threat‑intel feeds to reflect the observed indicators.