qurekunlogin[.]webflow[.]io

This domain, qurekunlogin.webflow.io, is flagged for brand_impersonation targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the site mimics Kraken’s official interface, presenting itself as an "Advanced Crypto Trading Platform" to deceive users into entering credentials or financial details. No specific drainer kit signatures were identified, but the domain’s structure and content align with credential harvesting tactics commonly used in crypto-related phishing campaigns. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., and resolves to the IPv6 address 2606:4700:440c::ac40:9708, hosted on Cloudflare’s network (AS13335). The domain was created on May 08, 2013, though recent malicious activity suggests it may have been compromised or repurposed. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites, which does not inherently confirm legitimacy. The domain is currently offline, likely due to takedown actions or suspension by the hosting provider. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to monitor for credential reuse attempts, particularly in crypto-related services, and to block the domain and associated IP addresses in network security controls. Users should verify the authenticity of crypto trading platforms by cross-referencing official domains and enabling multi-factor authentication to mitigate credential theft risks.