krakenlinknet[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation targeting Kraken, a cryptocurrency exchange. The page title, written in Russian, translates to 'Kraken link - darknet market of Russia, all links,' indicating the site attempts to mislead users into believing it provides access to a darknet marketplace under the Kraken brand. The domain was created on May 30, 2025, and remains active as of July 12, 2026, with a 200 HTTP status code. Infrastructure analysis reveals the domain resolves to IP 172.66.46.208, hosted in the United States on AS13335 (Cloudflare, Inc.), and uses Cloudflare nameservers (cash.ns.cloudflare.com and kara.ns.cloudflare.com). SSL certificate is issued by Google Trust Services (WE1). Security telemetry is strong: VirusTotal shows 9 of 95 security vendors flagging the domain, and Google Safe Browsing reports a SOCIAL_ENGINEERING threat. The domain appears on one security blocklist and is already blocked by PhishDestroy. Gridinsoft trust score is 0/100. Detected technologies include Yandex.Metrika for analytics, HSTS for security headers, and HTTP/3 for transport. The exact content of the landing page has not been visually analysed, but the combination of a low trust score, multiple vendor detections, social engineering flags, and brand impersonation targeting a known cryptocurrency exchange indicates a phishing or scam operation. Defenders should maintain blocklist entries, monitor for subdomain variations or new registrations under similar patterns, and warn users about unsolicited links claiming Kraken darknet access. The use of Cloudflare and Yandex.Metrika suggests an attempt to evade takedowns and track visitor engagement.