krekhnlogyin[.]webflow[.]io

This domain, krekhnlogyin.webflow.io, is identified as a high-risk brand_impersonation threat targeting the Kraken cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the legitimate Kraken interface, as evidenced by the page title 'Kraken Crypto Exchange | Buy crypto with peace of mind,' which closely mirrors the official branding. The threat type aligns with credential harvesting and potential cryptocurrency theft, leveraging social engineering to deceive users into disclosing sensitive account information or transferring funds to attacker-controlled wallets. Technical indicators confirm the malicious nature of this domain. VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious. Infrastructure analysis reveals the domain resolves to the IP address 172.64.151.8, hosted on Cloudflare infrastructure (AS13335). The domain is registered through Webflow, a platform often exploited for rapid deployment of impersonation pages. It appears on three security blocklists, and no legitimate creation date or historical WHOIS data is available, suggesting ephemeral use. The domain was not listed in Google Safe Browsing at the time of analysis, indicating either recent deployment or evasion techniques. Current status indicates the domain has been taken offline, likely due to enforcement actions by security providers such as PhishDestroy, MetaMask, and SEAL. Despite its offline status, residual risk remains for users who may have interacted with the domain prior to takedown. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this domain, particularly within cryptocurrency wallets or exchange accounts. Blocking the IP address 172.64.151.8 at the network level and adding the domain to internal blocklists can mitigate further exposure. Users should verify the authenticity of any communication or website claiming affiliation with Kraken by cross-referencing official domains and enabling multi-factor authentication.