kkrakkennllogain[.]webflow[.]io

The domain kkrakkennllogain.webflow.io poses a phishing threat by imitating the cryptocurrency exchange Kraken. Despite being offline, it is flagged as malicious by 9 out of 91 vendors on VirusTotal. This site is also listed on four public blocklists, including PhishDestroy, MetaMask, OpenPhish, and SEAL.

Registered through MarkMonitor Inc. and hosted on Cloudflare's infrastructure in the US, the domain's SSL certificate is issued by Google Trust Services. This indicates a sophisticated setup, often seen in phishing campaigns targeting high-profile brands like Kraken. The domain's creation dates back to 2013, but it was first detected by PhishDestroy in June 2026, suggesting a possible repurposing for malicious activity.

With a platform risk score of 75 out of 100, kkrakkennllogain.webflow.io represents a significant threat. The use of a reputable registrar and hosting provider, coupled with a valid SSL certificate, may have initially helped it evade detection. However, its eventual identification by multiple security vendors and inclusion in public blocklists highlights the effectiveness of collaborative threat intelligence efforts.

While the domain is currently offline, its previous activity underscores the importance of timely detection and reporting. The involvement of well-known entities like MetaMask and OpenPhish in flagging this domain further emphasizes the need for continuous monitoring of phishing threats, particularly those targeting the cryptocurrency sector.