kkrakkenullufgn[.]webflow[.]io

The domain kkrakkenullufgn.webflow.io was observed hosting a credential‑collection page targeting the cryptocurrency exchange Kraken. The page title "Way To Access Kraken Login Account | Trading Account with …" explicitly references Kraken, confirming brand impersonation. The site was served over HTTPS using a Google Trust Services certificate issued to the WE1 authority, indicating a valid TLS chain but offering no legitimacy. Infrastructure analysis shows the domain resolves to IP 172.64.151.8, an address owned by Cloudflare, Inc. (AS13335) located in the United States. Both authoritative nameservers, journey.ns.cloudflare.com and lamar.ns.cloudflare.com, are Cloudflare‑managed, reinforcing the use of Cloudflare’s reverse‑proxy services.

HTTP requests return a 404 status, suggesting the malicious landing page has been removed or is otherwise inaccessible at the time of analysis. The site employed Cloudflare’s HTTP/3 protocol, confirming modern transport support. Registrations were performed through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may obscure attribution. The domain was created on 8 May 2013, indicating long‑standing ownership but only recently weaponized for a crypto‑related scam. Detection engines on VirusTotal flagged the domain in 13 of 95 scans, and Google Safe Browsing classified it as a social‑engineering threat.

The domain appears on a single security blocklist and has been blocked by the PhishDestroy platform, providing additional defensive coverage. Evidence confirms a high‑risk, brand‑impersonation campaign aimed at extracting Kraken credentials for crypto theft. Uncertainty remains regarding the specific phishing kit or the extent of victim exposure, as the live content is no longer reachable. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host header or similar sub‑domains, and advise users to verify URLs before entering credentials.