kraken2vhod-cc[.]pages[.]dev

The domain kraken2vhod-cc.pages.dev is currently active and classified as a high-risk brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain hosts a fraudulent login portal designed to harvest user credentials, with the page title displayed as "Кракен вход — маркетплейс, ссылка и обновления," suggesting a focus on Russian-speaking users. The threat type is explicitly categorized as brand impersonation, with the intent to deceive victims into disclosing sensitive account information. Infrastructure analysis reveals the domain was registered on July 9, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.156, which is associated with AS13335 (Cloudflare, Inc.) in the United States. Detection metrics indicate the domain is flagged by 9 of 95 security vendors on VirusTotal, while Google Safe Browsing has explicitly labeled it as phishing. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of malicious domains leveraging legitimate certificate authorities to appear trustworthy. Current status confirms the domain remains operational, posing an ongoing risk to users. The combination of brand impersonation, active credential harvesting, and low detection rates among security vendors underscores the necessity for heightened vigilance. Users are advised to avoid interacting with the domain, verify URLs through official sources, and report the site to relevant security platforms. Organizations should update blocklists to include this domain and its associated IP address, while monitoring for similar infrastructure patterns in future phishing campaigns.