sso-krakn-web-docs[.]pineapple[.]page

The domain sso-krakn-web-docs.pineapple.page was observed delivering a page titled “Kraken login | sign in to your account”, indicating a brand‑impersonation attempt targeting Kraken users. The site was hosted on Vercel, as indicated by the registrar record and the presence of Vercel‑related technology fingerprints, and the front‑end stack reported React with HSTS enforced. An HTTPS endpoint was served using a Let’s Encrypt R13 certificate, and the server responded with HTTP 200, suggesting the page was reachable before takedown. Network resolution points to IP 216.150.1.193, which belongs to Amazon’s AS16509 infrastructure in the United States.

The domain was registered on 15 July 2025 through Vercel Inc., and the current status is offline, with PhishDestroy confirming removal. Reputation data shows the domain is flagged by Google Safe Browsing for social engineering, appears on a single security blocklist, and has a Gridinsoft trust score of 0 / 100. VirusTotal scans returned 17 detections out of 95 security vendors, reinforcing the malicious assessment. No nameserver information was returned, and no additional intelligence such as OTX indicators or malware payloads were disclosed.

Given the observed credentials‑theft vector, defenders should block the domain at perimeter and DNS layers, monitor Vercel‑hosted subdomains for similar brand‑impersonation patterns, and enforce user awareness messaging around unsolicited Kraken login requests. Continuous re‑scanning of the domain’s IP range is advised, as the underlying Amazon host may be reused for future campaigns. The lack of further artefacts beyond the page title and infrastructure details leaves the exact phishing flow uncertain, but the existing evidence warrants high‑severity handling.