en-krken[.]pages[.]dev

This domain, en-krken.pages.dev, is flagged for brand impersonation targeting the Kraken cryptocurrency exchange. Analysis of the page title, "How to Sign In — Sample: Kraken Login Guide," confirms the presence of a fake login portal designed to harvest user credentials. No direct evidence of a crypto drainer kit has been identified yet, but the infrastructure aligns with credential theft campaigns targeting financial platforms. The domain mimics legitimate Kraken branding to deceive users into submitting sensitive account details. Infrastructure analysis reveals the domain was created on April 14, 2026, and remains active under Cloudflare, Inc. registration. It resolves to the IP address 172.66.47.87, geolocated to a Cloudflare node in California. VirusTotal reports 0/95 detections, indicating the domain has not yet been widely flagged by security vendors. However, it appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious domains. Current status shows the domain remains operational, posing an ongoing risk to users. While automated detection systems have not yet broadly classified this domain as malicious, the combination of brand impersonation, fake login portal, and Cloudflare-hosted infrastructure warrants caution. Users are advised to verify domain authenticity before entering credentials and to report suspicious activity to their security teams. Monitoring for additional blocklist inclusions and behavioral indicators is recommended to assess evolving threats associated with this infrastructure.