kraken-web[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting the Kraken cryptocurrency exchange. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with legitimate Kraken services, potentially facilitating unauthorized access to accounts or cryptocurrency theft. The domain operates under a deceptive page title, 'Homerus - Demand Portal | Sesame,' which does not align with the expected branding of the targeted exchange, further suggesting malicious intent.

Infrastructure analysis reveals the domain was registered on April 26, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3 (AS13335, Cloudflare, Inc., US). It is currently active and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to mimic legitimacy. The domain's hosting provider and rapid inclusion in blocklists indicate a coordinated effort to evade detection while maintaining operational persistence.

Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP address (188.114.96.3) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to this domain, particularly for users interacting with cryptocurrency platforms. Security teams are advised to monitor for related indicators of compromise, such as unusual login attempts or transactions originating from this domain. User awareness training should emphasize the risks of interacting with unofficial domains, especially those mimicking trusted brands like Kraken. Additionally, affected users should be instructed to verify domain authenticity through official channels and report any suspicious activity to their security teams.