kraken-secure-webs-io[.]webflow[.]io

This domain, kraken-secure-webs-io.webflow.io, is a confirmed brand impersonation targeting Kraken, a cryptocurrency exchange, and is classified as a crypto scam. Infrastructure analysis reveals it was registered through MarkMonitor, Inc. on May 8, 2013, though its use for malicious activity appears recent. The domain resolves to IP 172.64.151.8, hosted on Cloudflare (AS13335), a common pattern for phishing sites leveraging Cloudflare's proxy services to obscure origin servers. Nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com further confirm Cloudflare's role in its infrastructure. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain's malicious intent.

Detection data indicates the domain is flagged by 15 of 95 security vendors on VirusTotal, a significant indicator of malicious activity. Google Safe Browsing explicitly flags it for social engineering, aligning with its classification as a crypto scam. The domain appears on at least one security blocklist and is blocked by PhishDestroy. Despite these detections, the domain currently returns an HTTP 404 status with the page title '404 - Page not found,' suggesting it may have been taken offline or is in a dormant state. The discrepancy between the domain's creation date (2013) and its recent malicious use warrants further investigation, as it may indicate domain repurposing or compromise.

Defenders should treat this domain as high-risk. Immediate actions include blocking the domain and its resolving IP (172.64.151.8) at the perimeter, updating SIEM rules to alert on any traffic to or from this domain, and monitoring for related infrastructure (e.g., subdomains, similar Cloudflare-hosted domains). Given the domain's association with Kraken, organizations handling cryptocurrency transactions should prioritize user education to prevent credential theft or fraudulent transactions.