loginn--kraken-sso[.]pages[.]dev

The domain loginn--kraken-sso.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline, returning an HTTP 403 status code. The site resolves to the IP address 172.66.45.28, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Its TLS certificate is issued by Google Trust Services under the WE1 authority, and the page title presented by the server is "Suspected phishing site | Cloudflare," indicating that the hosting provider has flagged the content.

The domain is listed on a single security blocklist, specifically PhishDestroy, and ten of ninety‑three VirusTotal scanners have flagged it as malicious, reflecting a moderate level of detection across the security community. Reputation services assign extremely low trust scores, with Gridinsoft reporting 0 out of 100 and Scamadviser reporting 1 out of 100, reinforcing the assessment that the site is untrustworthy. The observed technology stack includes HSTS, Cloudflare services, and HTTP/3, all typical of Cloudflare‑protected sites, and the domain employs the nameservers ned.ns.cloudflare.com and marge.ns.cloudflare.com.

Intelligence indicates that the site is categorized as a crypto scam and is explicitly impersonating the Kraken brand, a well‑known cryptocurrency exchange. While the offline status limits immediate threat exposure, defenders should continue to monitor the associated IP address and the Cloudflare nameservers for any re‑activation, enforce blocklist rules that include the domain and its IP, and apply brand‑specific detection rules for Kraken‑related traffic. The limited detection footprint—one blocklist entry and ten VirusTotal flags—suggests the campaign may be in early stages or targeted, so proactive filtering and user awareness campaigns are recommended to mitigate potential credential harvesting or financial fraud attempts.