kraken-hme[.]pages[.]dev

Analysis as of July 25 2026 indicates that the domain kraken-hme.pages.dev was registered on February 21 2026 through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2ef6, which is owned by AS13335 Cloudflare, Inc. in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that the content is currently inaccessible. SSL termination is performed by Google Trust Services under the WE1 certificate, and the server advertises HSTS, Cloudflare protection, and HTTP/3.

Reputation services show a strong consensus of malicious intent: VirusTotal recorded 14 detections out of 93 scanned vendors, Google Safe Browsing flags the site for social engineering, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. The identified scam type is “Crypto Scam” and the domain explicitly impersonates the cryptocurrency exchange Kraken, confirming a brand‑impersonation motive.

Given the high‑risk classification, defenders should immediately block kraken-hme.pages.dev at the DNS and proxy layers, enforce URL filtering, and monitor for any newly created sub‑domains that use the same Cloudflare nameservers (mcgrory.ns.cloudflare.com, heather.ns.cloudflare.com). Continuous observation of Cloudflare‑hosted assets targeting financial brands is advised, as the infrastructure—shared Cloudflare IP space and common SSL provider—facilitates rapid redeployment of similar impersonation sites. Incident response teams should also correlate internal logs for any attempted connections to the IPv6 address or the domain name to detect exploitation attempts before the site is taken offline.