# krakenqr-net.pages.dev — MALICIOUS

> krakenqr-net.pages.dev is a crypto drainer impersonating Kraken, flagged by 10/95 VirusTotal vendors and MetaMask. Block this domain immediately.

## Summary
PhishDestroy identifies krakenqr-net.pages.dev as an active crypto drainer impersonating the legitimate cryptocurrency exchange Kraken. The domain leverages Cloudflare's Pages.dev platform to host a fraudulent QR code generator interface, likely designed to trick users into scanning malicious QR codes that siphon cryptocurrency funds from their wallets. This domain has been explicitly flagged by Google Safe Browsing for social engineering tactics, which often involve misleading users into connecting their wallets or entering sensitive data under the guise of legitimate services.  This domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating widespread recognition of its malicious nature. It resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services to appear legitimate. Additionally, krakenqr-net.pages.dev has been blocked by MetaMask, a popular cryptocurrency wallet extension, and appears on at least one security blocklist, further corroborating its malicious intent.  Users who have visited krakenqr-net.pages.dev should immediately disconnect any connected cryptocurrency wallets from the site and revoke any permissions granted to suspicious domains. Clear browser cache and cookies related to the domain, and consider running a full antivirus scan. Report the domain to your wallet provider and security teams if you suspect any unauthorized transactions. Stay vigilant for similar brand impersonation attempts, especially those involving cryptocurrency platforms.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Kraken

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 10 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 1 hits
  Lists: ["MetaMask"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/krakenqr-net.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/krakenqr-net.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/krakenqr-net.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/krakenqr-net.pages.dev/
Last updated: 2026-04-09