krakanlougine[.]webflow[.]io

This domain, krakanlougine.webflow.io, is identified as a high-risk generic phishing resource specifically targeting cryptocurrency users. Analysis indicates the infrastructure was designed to harvest wallet credentials or private keys, a common tactic in cryptocurrency drainer operations. While no explicit brand impersonation is evident from the available metadata, the combination of Webflow hosting and Cloudflare IP resolution aligns with known phishing kit deployment patterns observed in prior campaigns. The page title '404 - Page not found' suggests either a staging environment, a takedown response, or an attempt to evade detection by presenting as a benign error page while retaining malicious backend functionality. Technical indicators confirm the domain's malicious classification. The resource resolves to IP address 104.18.36.248, associated with AS13335 (Cloudflare, Inc.) in the United States. VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious, with blocklist inclusion by three independent security feeds. The registrar of record is Webflow, a platform frequently exploited for rapid phishing site deployment due to its ease of use and low barrier to entry. No Google Safe Browsing (GSB) record is currently available, though this may reflect the domain's recent takedown or limited distribution. The unique seed identifier 406ca6 is assigned for tracking purposes across threat intelligence platforms. As of the latest assessment, krakanlougine.webflow.io has been taken offline, reducing immediate exposure risk. However, the infrastructure's Cloudflare-backed hosting and prior blocklist presence suggest potential for rapid redeployment under a new subdomain or similar naming convention. Users who may have interacted with this domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update web filtering rules to block the base domain and associated IP range to mitigate future iterations of this campaign. Persistent monitoring of Webflow-hosted subdomains with cryptocurrency-related naming patterns is recommended for early detection of resurfaced threats.