krakenlogi-in[.]pages[.]dev

Analysis of krakenlogi-in.pages.dev indicates a high‑risk brand impersonation campaign targeting Kraken users. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the nameservers tosana.ns.cloudflare.com and melany.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.180, which belongs to Cloudflare’s AS13335 network located in the United States. The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, confirming that the content has been taken offline at the time of assessment.

Despite the offline status, threat intelligence sources have already flagged the domain: Google Safe Browsing classifies it as social engineering, and PhishDestroy has added it to its blocklist. A Gridinsoft trust score of 0 out of 100 further reflects a lack of legitimacy. VirusTotal records show that 14 of 93 scanning vendors have identified malicious behavior, reinforcing the suspicion of abuse. The SSL certificate is issued by Google Trust Services under the WE1 designation, which is typical for Cloudflare‑protected sites but does not mitigate the observed risk.

The page employs modern web technologies such as HSTS and HTTP/3, consistent with legitimate Cloudflare deployments, yet these do not counteract the identified impersonation of the Kraken brand and the classification as a crypto‑related scam. Defenders should continue to block the domain and its associated IP address, monitor for any re‑activation attempts, and add the domain to internal threat feeds. Network sensors should be tuned to detect outbound connections to Cloudflare edge nodes that resolve to this IP, and user awareness campaigns should reference the specific impersonation of Kraken to reduce successful social‑engineering attempts. Given the current evidence, the domain poses a clear threat and should be treated as malicious until the infrastructure is fully dismantled.