cookie-kraken-site[.]pages[.]dev

This domain, cookie-kraken-site.pages.dev, is flagged as an active brand impersonation threat targeting Kraken, a cryptocurrency exchange. Analysis indicates the infrastructure is designed to mimic legitimate Kraken services, likely to facilitate credential theft or fraudulent transactions. The page title, 'who's up krakening they cookie,' suggests an attempt to appear informal or engaging, potentially lowering user vigilance. No direct evidence of a crypto drainer kit is present, but the domain's structure and branding align with known impersonation tactics used to harvest sensitive account details. Infrastructure analysis reveals the domain was registered on November 22, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendor assessments on VirusTotal show 2 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious domains. No detections were reported in Google Safe Browsing at the time of analysis. The domain remains active, posing a persistent risk to users who may mistake it for the legitimate Kraken platform. Response actions should include immediate blocking of the domain and IP at the network level, alongside user education to verify domain authenticity before entering credentials. Despite low vendor detection rates, the combination of brand impersonation, recent registration, and active status warrants high-risk classification. Organizations and individuals are advised to monitor for similar domains leveraging Cloudflare Pages infrastructure, as this hosting service is frequently abused for phishing campaigns due to its ease of deployment and free SSL certificates.