auth-kraken-co[.]pages[.]dev

auth-kraken-co.pages.dev was registered through Cloudflare on February 21, 2026 and is currently taken offline. The domain resolves to 172.66.44.241, an address owned by AS13335 Cloudflare, Inc. located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate certificate chain but not confirming the legitimacy of the hosted content. The HTTP response returned a 403 status code, which is consistent with an access‑denied page often used by malicious drop sites. The page title returned by the server is "Suspected phishing site | Cloudflare", and the site is explicitly marked as impersonating the cryptocurrency exchange Kraken.

Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on one security blocklist. VirusTotal analysis shows that 10 of 93 security vendors have flagged the domain as malicious, reinforcing the suspicion. The registrar information shows Cloudflare, Inc. as the registrar, and the authoritative nameservers are cortney.ns.cloudflare.com and conrad.ns.cloudflare.com. Detected technologies include HSTS and Cloudflare’s CDN services. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of abuse.

The available evidence confirms that the domain is being used for a crypto‑scam targeting Kraken users, but the exact payload or credential‑capture mechanisms have not been observed because the site is offline. Analysts should continue to block the domain at network perimeter devices, update DNS filtering rules, and monitor for new subdomains or similarly structured domains that reference Kraken. Additional investigation should focus on any recent traffic logs that reference the resolved IP address or Cloudflare edge nodes, and on correlating the ten VirusTotal detections to identify the specific malware families or threat actors involved.