kra-ken-log[.]pages[.]dev

Analysis of kra-ken-log.pages.dev indicates a high‑risk brand‑impersonation campaign targeting Kraken users. The domain, created on February 21, 2026, resolves to 172.66.47.121, an IP owned by Cloudflare (AS13335, United States). The site is served behind Cloudflare’s infrastructure, with HSTS and HTTP/3 enabled, and presents the page title "Suspected phishing site | Cloudflare". Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 15 of 93 scanning engines flag the host as malicious, confirming a consensus of threat detection.

The SSL certificate is issued by Google Trust Services under the WE1 designation, and the HTTP response currently returns a 403 status, consistent with the domain being taken offline. Reputation scoring from Gridinsoft is 0 / 100, indicating no trust, and the domain appears on a single security blocklist, specifically blocked by PhishDestroy. Registration details show the domain was provisioned through Cloudflare, Inc., and the authoritative nameservers are faye.ns.cloudflare.com and leo.ns.cloudflare.com. The observed indicators collectively point to a crypto‑scam that impersonates Kraken, likely aiming to harvest credentials or funds.

Uncertainty remains regarding the exact payload or user‑interaction flow, as the page content has not been captured beyond the title. Defenders should continue to block the domain at perimeter controls, monitor for any outbound connections to the resolved IP, and add the domain to internal threat intelligence feeds. Ongoing surveillance of Cloudflare‑hosted assets that mimic Kraken branding is recommended, as the infrastructure can be rapidly re‑used for similar campaigns.