krakenunbound-website[.]pages[.]dev

Analysis of krakenunbound-website.pages.dev shows a high‑risk brand‑impersonation infrastructure targeting Kraken users. The domain was registered on December 7, 2025 through Cloudflare, Inc., and uses Cloudflare nameservers denver.ns.cloudflare.com and raegan.ns.cloudflare.com. DNS resolution points to the IPv6 address 2a06:98c1:3121::3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served an HTTP 403 response and presented the page title "Suspected phishing site | Cloudflare," indicating that Cloudflare has flagged the content.

SSL termination is performed with a certificate issued by Google Trust Services under the WE1 profile, and the site employed HSTS and HTTP/3, consistent with modern Cloudflare deployments. Security‑vendor scans on VirusTotal recorded 11 detections out of 95 scanners, and Google Safe Browsing classified the URL as a social‑engineering threat. Independent reputation services such as Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on at least one security blocklist. PhishDestroy has already taken the site offline, and the current status is listed as offline.

The observed evidence points to a crypto‑scam campaign that masquerades as Kraken, likely aiming to harvest credentials or funds. While the exact phishing page content has not been captured, the combination of vendor detections, safe‑browsing flag, zero trust score, and blocklist inclusion provides strong confidence that the domain is malicious. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any related C2 infrastructure sharing the same IP range or Cloudflare account, and advise users to avoid any unsolicited Kraken‑related communications that reference this URL.