cloud-kraken-io[.]pages[.]dev

The domain cloud-kraken-io.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is serviced by the authoritative nameservers rayden.ns.cloudflare.com and autumn.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.20, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 framework, confirming that HTTPS connections are encrypted. HTTP responses return a 403 status code and the server announces HSTS and HTTP/3 support, indicating a modern Cloudflare edge configuration.

The page title returned by the server is "Suspected phishing site | Cloudflare," and the brand target is identified as Kraken, matching a crypto‑scam classification. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has listed it as blocked. VirusTotal analysis shows that 11 of 95 security vendors have flagged the domain, while a Gridinsoft trust score of 0 / 100 reflects a highly suspicious rating. The domain appears on a single external blocklist.

Current operational status is offline, suggesting the phishing infrastructure has been taken down or is no longer active. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or similar sub‑domains, and incorporate the observed indicators—IP 172.66.47.20, ASN 13335, TLS issuer, and the 403 response—into threat‑intel feeds. Given the confirmed impersonation of Kraken and the presence of multiple vendor detections, the risk rating remains high, and remediation actions should prioritize the removal of any residual references in user‑facing systems.