kra-ken--log-in[.]pages[.]dev

The domain kra-ken--log-in.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and is hosted on Cloudflare's network (AS13335). DNS resolution points to IP address 172.66.44.133, which is geolocated to the United States and belongs to Cloudflare's edge infrastructure. The domain uses Cloudflare-provided nameservers daphne.ns.cloudflare.com and suullivan.ns.cloudflare.com, and TLS termination is performed by a Google Trust Services certificate (WE1). HTTP requests return a 403 status code and the page title presented by the server is "Suspected phishing site | Cloudflare", indicating that the site has been taken offline or is being blocked by Cloudflare's protective mechanisms.

Security assessments show a Gridinsoft trust score of 0 out of 100, and the site is flagged by Google Safe Browsing for social engineering. It appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis reports that 14 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of malicious intent. The site is classified as a Crypto Scam and explicitly impersonates the cryptocurrency exchange Kraken.

Detected technologies include HTTP/3, HSTS, and Cloudflare's CDN services. Current evidence does not include a content scrape or screenshot, so the exact phishing payload or credential collection mechanisms remain unknown. Defenders should immediately block the domain and its associated IP address at perimeter and DNS layers, add the domain to internal threat intel feeds, and monitor for any related subdomains or similar naming patterns. Continuous observation of Cloudflare edge IP ranges for anomalous activity related to the Kraken brand is advised, as threat actors often leverage shared hosting services to rotate infrastructure quickly.