krakanlogin[.]pages[.]dev

Analysis of krakanlogin.pages.dev indicates a brand-impersonation phishing domain targeting Kraken, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to IP 172.66.47.3, hosted on Cloudflare's network (AS13335). SSL certificate issued by Google Trust Services (WE1) confirms encrypted connections, though this does not validate legitimacy. The domain appears on one security blocklist, and 12 of 93 security vendors on VirusTotal flagged it as malicious, aligning with its classification as a brand impersonation scam.

Scamadviser and Gridinsoft trust scores are both 0/100, further supporting its fraudulent nature. The page title, 'Suspected phishing site | Cloudflare,' explicitly labels the domain as suspicious, and the HTTP 403 status suggests access restrictions, likely due to takedown or protective measures. Infrastructure analysis reveals Cloudflare hosting and nameservers (tosana.ns.cloudflare.com, melany.ns.cloudflare.com), common among both legitimate and malicious sites. The domain's creation date and detection by PhishDestroy reinforce its association with phishing activity.

While the exact content of the site remains unanalyzed, the available indicators—brand target, scam type, and detection by multiple security vendors—confirm its intent to impersonate Kraken. Defenders should treat this domain as malicious, block it at the network level, and monitor for related infrastructure, particularly subdomains under pages.dev or Cloudflare-hosted IPs. No evidence suggests active exploitation at this time, but historical logs should be reviewed for connections to 172.66.47.3 or the domain itself.