auth-kraken-walcom[.]pages[.]dev

On 24 July 2026, the domain auth-kraken-walcom.pages.dev was observed as a high‑risk, brand‑impersonation site targeting Kraken. The domain was registered through Cloudflare on 21 February 2026 and resolves to the IPv6 address 2606:4700:310c::ac42:2c35, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. Both authoritative name servers, plato.ns.cloudflare.com and gabriella.ns.cloudflare.com, are operated by Cloudflare, indicating that the infrastructure is fully hosted behind the provider’s edge network. The site presented a TLS certificate issued by Google Trust Services under the WE1 name, and the HTTP response returned a 403 status code. Detected technologies include HTTP/3, HTTP Strict Transport Security (HSTS), and Cloudflare’s reverse‑proxy services.

Threat intelligence aggregators have flagged the domain. VirusTotal recorded detections from 11 of 93 scanned security vendors, and Google Safe Browsing classified the URL as a social‑engineering threat. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already taken the site offline, and the current status is listed as offline. The page title returned by the server is “Suspected phishing site | Cloudflare,” confirming that the hosting provider has labeled the content as suspicious.

While the available data confirm the use of Cloudflare infrastructure and a valid TLS certificate, the actual malicious payload or credential‑harvesting page has not been captured, leaving the precise phishing methodology unknown. No additional indicators such as malicious scripts, command‑and‑control endpoints, or compromised accounts have been disclosed. Consequently, defenders should prioritize blocking the domain at the DNS and proxy level, monitor for any subsequent sub‑domains that may be registered under the same Cloudflare account, and enforce strict email filtering for messages that reference Kraken login URLs.