secure-exploreokraken-sso[.]pages[.]dev

The domain secure-exploreokraken-sso.pages.dev is confirmed to be a brand impersonation site targeting the digital asset exchange Kraken. This domain poses a high risk of misleading users into believing they are interacting with a legitimate Kraken service, potentially leading to the theft of personal information, credentials, or financial data. The threat is primarily centered around creating a convincing but fraudulent user interface that mimics the official Kraken site.

Infrastructure analysis reveals that the domain secure-exploreokraken-sso.pages.dev resolves to the IP address 172.66.45.23, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was registered through Cloudflare, Inc. on October 17, 2025. This domain has been flagged by 12 out of 95 security vendors on VirusTotal, indicating a moderate consensus on its malicious nature. Additionally, the site appears on one known security blocklist and is marked as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services / WE1, which may contribute to users' false sense of security when visiting the site.

If users have visited secure-exploreokraken-sso.pages.dev, they are advised to immediately change any passwords or credentials that may have been entered on the site. It is recommended to monitor financial and account activity for any unauthorized transactions or access. Users should also consider enabling multi-factor authentication on their Kraken accounts and other digital asset exchanges to add an extra layer of security. Reporting the incident to the official Kraken support team and to local cybersecurity authorities is also advised to help mitigate the impact of this threat.