kerkkeenlognn[.]webflow[.]io

Analysis of kerkkeenlognn.webflow.io, observed on July 23, 2026, shows a high‑risk crypto‑related impersonation campaign targeting Kraken users. The site presented the page title "Kraken Login Portal: Your Gateway to Crypto Trading," directly referencing the legitimate exchange brand. The domain resolves to 172.64.151.8, an address owned by AS13335 Cloudflare, Inc., and is served behind Cloudflare’s edge network with HTTP/3 support. The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, a common certificate for Cloudflare‑hosted sites, providing no intrinsic trust indication for the malicious content.

Registration data indicates the domain was created on May 08, 2013 and is registered through MarkMonitor, Inc., a registrar often used by legitimate enterprises. Nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com confirm the Cloudflare hosting arrangement. Despite the long registration age, the site is currently offline and returns an HTTP 404 status, limiting direct content analysis. However, external threat‑intel sources have recorded the domain as a crypto scam. Google Safe Browsing flags the URL for social engineering, and 12 of 95 VirusTotal scanners have marked it as malicious. The domain appears on a single active security blocklist and has been explicitly blocked by PhishDestroy.

The combination of brand impersonation, a credential‑themed page title, Cloudflare infrastructure, and multiple vendor detections confirms that the domain was used for a Kraken‑targeted credential‑harvesting or crypto‑drain operation. Defenders should add kerkkeenlognn.webflow.io to URL filtering rules, DNS blocklists, and endpoint telemetry filters. Continuous monitoring of Cloudflare‑hosted subdomains and similar naming patterns is advised, as threat actors often reuse the same infrastructure for new campaigns.