get-krakn-login[.]pages[.]dev

The domain get-krakn-login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.89, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are bart.ns.cloudflare.com and collins.ns.cloudflare.com, indicating that the site is hosted entirely on Cloudflare’s edge network. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, suggesting that the content is being blocked or restricted at the web server level. The SSL certificate is issued by Google Trust Services under the designation WE1, confirming that TLS is correctly provisioned but does not imply legitimacy of the content.

Multiple detection mechanisms have flagged the domain. Google Safe Browsing classifies it as a social engineering threat, and VirusTotal reports that 14 out of 93 scanned security vendors have flagged the domain as malicious. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, and it is listed as a high‑risk brand‑impersonation campaign targeting Kraken, a cryptocurrency exchange. The technology stack detected includes HSTS, Cloudflare, and HTTP/3, all typical of Cloudflare‑hosted services.

The observable evidence confirms that the domain is being used in a crypto‑related brand‑impersonation campaign, consistent with the known scam type of a crypto scam. However, the site is currently offline, and no additional content analysis (such as page markup or credential‑harvesting forms) is available. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intelligence feeds with the identified IP address and domain, and monitor for any re‑registration attempts or new subdomains that reuse similar naming patterns.