krraknelugein[.]webflow[.]io

This domain, krraknelugein.webflow.io, poses a targeted credential theft threat against users of the Kraken cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to mimic the legitimate Kraken login portal, presenting a page titled 'Kraken Account Login: Your Gateway to Global Cryptocurrency Markets.' The objective is to harvest user credentials, which could subsequently enable unauthorized access to cryptocurrency wallets and exchange accounts, leading to potential financial loss or further exploitation in secondary attacks such as crypto drainers or account takeovers.

Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain, hosted on Cloudflare infrastructure (IP 172.64.151.8, AS13335), was flagged by 14 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. Despite its creation date of May 08, 2013, the domain appears to have been repurposed for phishing, as evidenced by its recent appearance on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), aligns with common phishing tactics to appear legitimate. The domain was registered through MarkMonitor, Inc., a registrar frequently associated with both legitimate and malicious domains.

Users who visited krraknelugein.webflow.io should take immediate action to mitigate risk. Any credentials entered on this site must be considered compromised and should be changed immediately across all platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all cryptocurrency exchange accounts and monitor for unauthorized transactions. If financial loss is suspected, report the incident to relevant authorities and the targeted platform. Review system logs for signs of compromise, such as unexpected outbound connections to the domain or its associated IP (172.64.151.8). Given the elevated risk level, affected users should also consider revoking active sessions and generating new wallet addresses for enhanced security.