login-kraaken[.]pages[.]dev

The domain login-kraaken.pages.dev was registered on February 21, 2026 and is hosted behind Cloudflare’s network (ASN13335, United States) at IP address 172.66.47.119. The site presents the page title "Suspected phishing site | Cloudflare" and is identified as a brand‑impersonation campaign targeting Kraken, classified as a crypto‑related scam. Technical analysis shows the presence of HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services (WE1). An HTTP request returns a 403 status, and Google Safe Browsing flags the URL for social engineering.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal reports that 11 of 93 scanned security vendors have flagged the domain, reinforcing its malicious reputation. Reputation services assign extremely low trust scores, with Gridinsoft rating it 0 / 100 and Scamadviser 1 / 100. The registrar information lists Cloudflare, Inc. as the registration service, and the domain’s authoritative nameservers are cris.ns.cloudflare.com and pat.ns.cloudflare.com.

Current operational status is offline, indicating that the phishing page has been taken down. Defenders should continue to block the domain at network perimeter and DNS layers, ensure that endpoint security solutions incorporate the observed VirusTotal detections, and monitor for any new subdomains or similar patterns that reuse the same Cloudflare infrastructure. Because the domain is already flagged by multiple reputable sources, inclusion in internal blocklists and sharing of the indicator of compromise with threat‑intelligence platforms is advised to prevent potential credential harvesting attempts against Kraken users.