loginkkerken[.]webflow[.]io

On July 23, 2026, the domain loginkkerken.webflow.io was identified as a high‑risk brand‑impersonation infrastructure targeting Kraken users. The site is currently offline, returning HTTP 404, and its SSL certificate is issued by Google Trust Services under the WE1 label. Registration data shows the domain was created on May 08, 2013 and is listed with MarkMonitor, Inc., a registrar often associated with legitimate brand protection services.

DNS resolution points to 104.18.36.248, an address owned by Cloudflare (AS13335) located in the United States; the authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the service advertises HTTP/3 support. Google Safe Browsing flags the domain for social engineering, and VirusTotal analysis recorded 16 of 95 security vendors labeling the host as malicious. The domain appears on a single security blocklist and has been blocked by PhishDestroy.

The page title captured from the site – "Kraken ℒogin® | Log in to My Account (Official Website)" – aligns with the declared crypto scam motive and confirms the impersonation of the Kraken brand. Defenders should continue to enforce network‑level blocks for the IP 104.18.36.248 and the domain itself, monitor Cloudflare edge locations for any re‑activation, and incorporate the observed Safe Browsing and vendor detection signals into threat‑intel feeds. Ongoing vigilance is advised because the infrastructure leverages a reputable registrar and CDN, which can facilitate rapid re‑deployment if the actors regain hosting access.