auth-krakeen-com-en[.]pineapple[.]page

Analysis of auth-krakeen-com-en.pineapple.page was performed on July 24, 2026. The site presented the page title “Sign in - Kraken | Buy, Sell and Margin Trade Bitcoin”, directly referencing the Kraken cryptocurrency exchange, indicating a brand‑impersonation campaign aimed at credential harvesting. Infrastructure inspection shows the domain resolves to IP 216.150.16.193, an address owned by Amazon.com, Inc. (AS16509) and hosted on the Vercel platform. The SSL certificate is issued by Let’s Encrypt (certificate identifier R13), providing valid TLS encryption but offering no assurance of legitimacy.

HTTP response code 200 was observed, and the page delivered content built with React and served over HSTS, a common stack for modern phishing kits. The domain was registered through Vercel Inc., and no authoritative nameserver records were discovered (NS_NOT_FOUND). Reputation services flag the domain as high risk: Google Safe Browsing classifies it as social engineering, PhishDestroy has taken the site offline, and Gridinsoft assigns a trust score of 0/100. VirusTotal recorded detections from 15 of 95 scanning engines, and the domain appears on one external blocklist.

These data points collectively confirm the presence of a credential‑stealing operation targeting Kraken users. Uncertainties remain regarding the original registration date, any additional infrastructure used for command‑and‑control, and whether the site hosted any malware beyond the phishing page. Defenders should immediately block the domain and its resolved IP at network perimeters, add the host to internal phishing‑filter lists, and monitor for other Vercel‑hosted domains that serve similar page titles. Continuous observation of Let’s Encrypt‑issued certificates tied to the same IP range may help detect future replications of this impersonation kit.