app-gitkraken-bkf[.]pages[.]dev

The domain app-gitkraken-bkf.pages.dev was observed on July 23, 2026 as a high‑risk brand‑impersonation site targeting Kraken users. The site was created on March 23, 2026 and is hosted on Cloudflare’s network, resolving to IP address 172.66.46.235, which is geolocated to Canada and associated with Cloudflare, Inc. The domain is registered through Cloudflare, Inc. and uses the Cloudflare nameservers greg.ns.cloudflare.com and isabel.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) protects the connection, and the service presents HSTS and HTTP/3 headers, indicating a modern TLS configuration. The page title reported is “Login - GitKraken.dev”, and the site is classified as a crypto‑scam that impersonates the Kraken brand. Automated scanning by VirusTotal recorded 11 detections out of 94 security vendors, and the domain appears on three independent blocklists.

Additional protection services—PhishDestroy, MetaMask, and SEAL—have listed the domain as blocked. The HTTP response returned a 403 status code, and the Gridinsoft trust score is 0 out of 100, reflecting a severe lack of trust. Current activity status is offline; the site was taken down prior to this report. Nevertheless, the infrastructure components (Cloudflare hosting, valid TLS, and the use of a legitimate‑looking subdomain under pages.dev) suggest the operators intentionally leveraged reputable services to increase credibility. No further content was captured, and the exact phishing page layout remains unverified.

Defenders should continue to block the domain at network perimeter and update URL filtering lists with the observed indicators. Monitoring of the associated IP address and Cloudflare account for any re‑registration attempts is advised.