krakencalculadora[.]pages[.]dev

This domain, krakencalculadora.pages.dev, poses a high-risk brand impersonation threat specifically targeting users of the Kraken cryptocurrency exchange. The site mimics legitimate Kraken services under the guise of a 'Calculadora de Gas' tool, likely designed to deceive users into entering sensitive credentials or wallet information. Given the domain's association with cryptocurrency operations, the risk extends beyond credential theft to potential financial loss through unauthorized transactions or crypto draining attacks. The page title, 'Kraken - Calculadora de Gas,' reinforces the deception by closely aligning with Kraken's branding and service offerings, increasing the likelihood of user engagement under false pretenses.

Analysis indicates the domain was registered on January 13, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.162, hosted on Cloudflare's infrastructure (AS13335). Security vendors have flagged the domain as malicious, with 10 out of 95 VirusTotal engines detecting it as fraudulent. The domain appears on three security blocklists and is explicitly blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. Google Safe Browsing has also classified the domain as phishing. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as it is commonly used by both legitimate and malicious sites to evade basic security checks.

Users who visited krakencalculadora.pages.dev should immediately revoke any active sessions associated with the domain and reset credentials for their Kraken accounts, as well as any other platforms where identical or similar passwords were used. If wallet information or private keys were entered, affected users must transfer assets to a new, secure wallet and monitor transaction histories for unauthorized activity. Browser data, including cookies and cached credentials, should be cleared to eliminate residual session tokens. Organizations should update internal blocklists to include this domain and its associated IP address (172.66.44.162) to prevent further access. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts targeting Kraken or other cryptocurrency services.