sso-kraken-login-us[.]pages[.]dev

Analysis of the domain sso-kraken-login-us.pages.dev indicates it was actively impersonating the Kraken cryptocurrency exchange platform as recently as July 24, 2026. The domain, registered on September 2, 2020, through Cloudflare, Inc., was hosted on Cloudflare's infrastructure (AS13335) and resolved to the IP address 172.66.45.31. At the time of assessment, the site returned an HTTP 403 status, suggesting access restrictions or takedown efforts. The page title, 'Log In | BlueWave Exchange®,' does not match Kraken’s official branding, further supporting the impersonation classification.

Security vendor detections on VirusTotal show 12 of 93 engines flagging the domain, aligning with its presence on at least one security blocklist (PhishDestroy). The domain’s SSL certificate, issued by Google Trust Services (WE1), and technologies such as HSTS and HTTP/3, are consistent with legitimate services but do not mitigate the fraudulent intent. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk status. While the domain is currently offline, its prior use for crypto-related scams warrants continued monitoring.

Defenders should treat this domain as part of a broader Kraken impersonation campaign, particularly given the mismatch between the page title and the targeted brand. No evidence confirms the exact scam mechanics (e.g., credential harvesting, wallet drainers), but the combination of crypto branding and phishing indicators justifies blocking and alerting users. Organizations should review logs for connections to 172.66.45.31 or the domain itself and consider proactive takedown requests for similar infrastructure.