kraken-kinks[.]pages[.]dev

The domain kraken-kinks.pages.dev was registered on May 26, 2025 and is currently taken offline. DNS resolution points to IP address 172.66.44.80, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is hosted through Cloudflare, Inc., with authoritative nameservers cash.ns.cloudflare.com and kara.ns.cloudflare.com, and the site served an HTTP 403 response while advertising HSTS and HTTP/3 support. The presented SSL certificate is issued by Google Trust Services under the WE1 designation, matching the page title "Suspected phishing site | Cloudflare".

Threat intelligence categorizes the activity as a crypto scam that impersonates the Kraken brand, and the page is flagged by Google Safe Browsing for social engineering. VirusTotal analysis shows that 10 of 95 scanned security vendors flagged the domain, and it appears on a single external blocklist, identified by PhishDestroy. Additional assessment by Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent. While the site is no longer reachable, the combination of brand impersonation, malicious SSL context, and multiple vendor detections provides strong evidence of a targeted cryptocurrency credential harvesting operation.

Uncertainty remains regarding the exact payload or credential harvesting mechanisms, as no page content beyond the title has been publicly disclosed. Defenders should add kraken-kinks.pages.dev to deny‑list rules, monitor for similar Cloudflare‑hosted subdomains that resolve to the same IP range, and enforce strict email filtering for communications purporting to originate from Kraken. Ongoing vigilance for Cloudflare‑issued certificates tied to suspicious domains is also advised.