kraken-homee[.]pages[.]dev

Analysis of kraken-homee.pages.dev, observed as offline as of July 24 2026, indicates a high‑risk brand‑impersonation campaign targeting users of the cryptocurrency exchange Kraken. The domain was registered on February 21 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 188.114.96.3, an AS13335 endpoint located in the United States. The site is served behind Cloudflare’s edge platform, employing HSTS and HTTP/3, and presents a valid SSL certificate issued by Google Trust Services under the WE1 root, which may lend an appearance of legitimacy. The page title returned by the server is "Suspected phishing site | Cloudflare", and the HTTP response code is 403, suggesting that the content is blocked or taken down. The domain has a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation.

VirusTotal analysis shows that 14 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. Google Safe Browsing classifies the site under social engineering, and PhishDestroy has added it to its blocklist; an additional security blocklist also contains the domain. The observed indicators align with the declared scam type of a crypto‑related scam, and the brand field explicitly names Kraken as the impersonated target. Because the site is currently offline and no content snapshot is available, the exact phishing vector cannot be confirmed, leaving the visual branding, form fields, or redirect behavior unknown.

Defenders should add the full hostname kraken-homee.pages.dev to internal DNS block lists and to any external threat‑intelligence feeds they consume. Email gateways should be configured to flag messages containing this domain or any URLs that resolve to 188.114.96.3 with a Cloudflare‑originating certificate. Monitoring for future re‑registration of the same sub‑domain pattern on Cloudflare or for similar domains that imitate Kraken is advised.