situs-kraken128[.]pages[.]dev

The domain situs-kraken128.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.148, ASN 13335 in the United States. The site presents a page titled “KRAKEN128: Kuasai Lautan Kemenanganmu!” and claims to be associated with the cryptocurrency exchange Kraken, indicating a brand‑impersonation campaign aimed at crypto users. HTTPS is enforced via HSTS, the service uses Cloudflare’s HTTP/3 stack, and the presented TLS certificate is issued by Google Trust Services under the “WE1” profile, consistent with a legitimate Cloudflare front‑end.

An HTTP 403 response was observed, suggesting the content is currently inaccessible, and the domain is listed as offline by monitoring services. Threat‑intelligence feeds show that 11 of 93 VirusTotal scanners flagged the domain as malicious, and the site is currently blocked by the PhishDestroy filter. It also appears on one external security blocklist, and Gridinsoft assigns it a trust score of 0 / 100, reinforcing the suspicion of a crypto scam.

No additional payload or page content has been captured, so the exact phishing tactics remain unknown. Defenders should continue to block the hostname at DNS and web‑filter layers, monitor Cloudflare‑served IP ranges for any resurgence, and advise Kraken users to disregard any unsolicited communications that reference “Kraken128” or the page title. Incident response teams should also submit the domain to additional sandbox environments to confirm the presence of credential‑stealing or malware‑delivery mechanisms.