kraken--hme[.]pages[.]dev

This domain, kraken--hme.pages.dev, is identified as a high-risk brand impersonation threat targeting Kraken, a cryptocurrency exchange platform. Analysis confirms the domain was actively used for phishing operations before being taken offline. The impersonation tactic suggests an attempt to deceive users into divulging credentials or financial information by mimicking legitimate Kraken services. Infrastructure analysis reveals the domain was registered on October 24, 2025, through Cloudflare, Inc. It resolves to the IP address 188.114.97.3, hosted within AS13335 (Cloudflare, Inc.) in the United States. Security vendor detections include 14 of 95 flags on VirusTotal, with Google Safe Browsing explicitly classifying it as phishing. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. As of the latest assessment, kraken--hme.pages.dev is offline, likely due to takedown actions or infrastructure suspension. Organizations and users are advised to block the domain and its associated IP (188.114.97.3) at the network level. Security teams should monitor for related domains using similar naming patterns (e.g., 'kraken--' prefixes) and update detection rules to include this domain in threat intelligence feeds. Users who may have interacted with the domain should reset credentials and review account activity for unauthorized transactions.