kraken12at[.]pages[.]dev

The domain kraken12at.pages.dev is currently active and confirmed as a brand impersonation site targeting Kraken, a major cryptocurrency exchange platform. This domain is designed to deceive users into believing they are interacting with legitimate Kraken services, potentially facilitating unauthorized access to sensitive account information or cryptocurrency assets. Analysis indicates a deliberate attempt to exploit the trust associated with the Kraken brand for malicious purposes. Infrastructure analysis reveals the following technical indicators: the domain is hosted on Cloudflare infrastructure (AS13335) and resolves to the IP address 172.66.44.59. It was registered on February 21, 2026, through Cloudflare, Inc., which is atypically recent for a domain impersonating an established brand. The domain is flagged by 2 of 95 security vendors on VirusTotal, and it appears on three distinct security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is commonly leveraged by threat actors to lend a false sense of security to their fraudulent sites. Current assessment places this domain at a high risk level due to its active status and confirmed malicious intent. Users are strongly advised to avoid interaction with kraken12at.pages.dev and any associated subdomains or redirects. Organizations should update their security controls to block this domain at the network level, including DNS filtering and endpoint protection rules. Verification of cryptocurrency wallet addresses and multi-factor authentication (MFA) tokens is recommended for any users who may have engaged with this domain prior to its identification as malicious. Continuous monitoring for similar impersonation domains is advised, particularly those leveraging Cloudflare Pages infrastructure or mimicking cryptocurrency exchange branding.