krrkenloggi[.]webflow[.]io

The domain krrkenloggi.webflow.io has been identified as a brand impersonation threat targeting the cryptocurrency exchange Kraken. Analysis indicates the site functions as a fake login portal, designed to harvest user credentials under the guise of the legitimate Kraken platform. At the time of assessment, the domain is reported as offline, though prior activity remains a concern for historical exposure. Technical indicators reveal the domain was flagged by 13 of 95 security vendors on VirusTotal, a notable detection rate for credential-theft infrastructure. Registration details show the domain was created on May 8, 2013, though the subdomain under webflow.io appears to have been repurposed for malicious activity. The domain resolves to the IP address 172.64.151.8 and is associated with a single security blocklist entry. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging free certificate authorities. Infrastructure analysis further confirms the domain was registered through MarkMonitor, Inc., a registrar frequently used for both corporate and fraudulent domains. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the historical presence of this fake login portal warrants caution. Users who may have interacted with the site should immediately revoke any active sessions, reset credentials for associated accounts, and enable multi-factor authentication where available. Organizations monitoring for brand abuse should update detection rules to include this domain and its associated IP address in historical logs. Continuous monitoring of newly registered subdomains under webflow.io and similar hosting platforms is recommended to identify potential resurgence or copycat campaigns.