kraken-logged-in[.]pages[.]dev

kraken-logged-in.pages.dev was observed on 21 February 2026 as a newly registered domain hosted on Cloudflare’s infrastructure. The registrar record shows Cloudflare, Inc. as the registrar and the authoritative nameservers margot.ns.cloudflare.com and nicolas.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335, a Cloudflare network located in the United States. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 certificate authority, indicating a valid HTTPS endpoint. An HTTP GET request returns a 403 status code and the page title “Suspected phishing site | Cloudflare”, which aligns with the reported scam type of a crypto‑related phishing campaign targeting Kraken users.

The site is listed on a single public blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classifies the URL as social engineering, and VirusTotal analysis shows 14 of 93 scanning engines flag the domain as malicious. Independent trust scoring from Gridinsoft assigns a score of 0 out of 100, reflecting a lack of trust. The domain is currently offline, and no further content is reachable for deeper behavioural analysis.

While the available data confirms a high‑risk brand impersonation attempt against Kraken, the exact phishing payload, credential‑capture mechanisms, and any associated command‑and‑control infrastructure remain unknown. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the domain and its IP prefix, and update detection rules to include the observed HTTP 403 response combined with the Cloudflare page title. Additional telemetry from endpoint security solutions should be correlated with the 14 VirusTotal detections to identify any compromised hosts. Ongoing observation of the Cloudflare IP range for similar patterns is recommended, as the infrastructure could be reused for future impersonation campaigns.