public-kraken-eng[.]pages[.]dev

Analysis of the domain public-kraken-eng.pages.dev, conducted on July 23, 2026, indicates a high-risk phishing campaign targeting the Kraken cryptocurrency exchange brand. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 188.114.96.3, which is associated with AS13335 (Cloudflare, Inc.) and geolocated in the United States. The domain's nameservers, walk.ns.cloudflare.com and alex.ns.cloudflare.com, further confirm its hosting on Cloudflare's infrastructure. Technologies detected include HSTS, Cloudflare security services, and HTTP/3, which are consistent with modern web hosting but do not mitigate the domain's malicious intent. The domain is flagged for brand impersonation, specifically mimicking Kraken, a well-known cryptocurrency platform.

Google Safe Browsing classifies the site as engaging in social engineering, a common tactic in phishing campaigns designed to deceive users into disclosing sensitive information. At the time of analysis, the domain appears on one security blocklist, having been blocked by PhishDestroy. VirusTotal reports that 13 out of 93 security vendors have flagged the domain as malicious, providing additional corroboration of its fraudulent nature. The domain's SSL certificate is issued by Google Trust Services (WE1), which is typical for legitimate and malicious sites alike and does not indicate trustworthiness in this context. Gridinsoft assigns the domain a trust score of 0/100, reflecting its high-risk classification.

The domain is currently offline, returning an HTTP 403 status, and its page title is listed as 'Suspected phishing site | Cloudflare,' which aligns with its detection status. Defenders should treat this domain as part of a broader crypto scam campaign targeting Kraken users.