krakenrpc[.]pages[.]dev

Analysis identifies krakenrpc.pages.dev as an active brand impersonation domain targeting the Kraken cryptocurrency platform. The observed content uses the page title "MainNet Project" while presenting infrastructure characteristics consistent with credential harvesting or fraudulent onboarding workflows associated with cryptocurrency-themed phishing campaigns. Current telemetry indicates that the domain remains active and accessible at the time of assessment, supporting a high-risk classification due to the combination of brand abuse indicators and ongoing availability. The use of recognizable branding elements combined with generic project terminology increases the probability of user deception and unauthorized account access attempts.

Infrastructure analysis reveals that the domain resolves to IP address 188.114.96.3 and is hosted within AS13335 operated by Cloudflare, Inc. Registration records indicate that the domain was created on December 04, 2025 and was registered through Cloudflare, Inc. Reputation analysis shows that the domain currently appears on 1 security blocklist and has been specifically blocked by PhishDestroy. Detection telemetry indicates that 15 of 95 security vendors on VirusTotal classify the domain as malicious or phishing-related infrastructure. Additional threat intelligence confirms that Google Safe Browsing flags the domain for phishing activity. The site currently presents an SSL certificate issued by Google Trust Services using the WE1 issuing hierarchy, demonstrating that transport encryption is present despite the malicious assessment and should not be interpreted as evidence of legitimacy.

The domain remains active and should be treated as hostile infrastructure until independent verification demonstrates otherwise. Security teams should implement immediate blocking at network, DNS, proxy, and email security layers where applicable. Any credentials, wallet information, recovery phrases, authentication tokens, or account details entered through this infrastructure should be considered potentially compromised and subject to incident response procedures. Users encountering references to this domain should avoid interaction, preserve relevant artifacts for investigation, and verify access paths through trusted official channels rather than links delivered through messages, advertisements, or unsolicited communications. Continued monitoring is recommended due to the possibility of rapid content changes or infrastructure migration associated with phishing operations.