kraken-darknet-onion-net[.]pages[.]dev

The domain kraken-darknet-onion-net.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and uses the Cloudflare nameservers may.ns.cloudflare.com and ryan.ns.cloudflare.com. DNS resolution points to the IP address 172.66.44.212, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, confirming that the connection is encrypted but does not imply legitimacy. Network analysis shows the domain enforces HTTP Strict Transport Security and supports HTTP/3, indicating modern web infrastructure. An HTTP request returns status code 403, suggesting the page is currently inaccessible.

The page title observed in the response is “Kraken маркет сайт вход | ссылка на сайт площадка Kraken,” which directly references the cryptocurrency exchange Kraken and aligns with the reported brand impersonation. Google Safe Browsing classifies the URL as a social engineering threat. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme suspicion. VirusTotal analysis records thirteen detections out of ninety‑five scanning engines, reinforcing the malicious assessment.

Given the combination of a brand‑specific page title, the crypto‑scam classification, and the multiple independent detections, the domain is evaluated as high risk. Although the site is currently offline, defenders should continue to deny any traffic to the IP address 172.66.44.212 and to the full domain name, update intrusion detection signatures, and monitor for re‑registration or the appearance of similarly structured subdomains on the pages.dev namespace.