kraken-mirrors[.]pages[.]dev

The domain kraken-mirrors.pages.dev is currently operating as a high-risk brand impersonation site targeting Kraken, a well-known cryptocurrency exchange platform. Analysis indicates the site presents itself as an official marketplace mirror under the title «Кракен зеркала на официальный маркетплейс», explicitly mimicking Kraken’s branding to deceive users into engaging with fraudulent services. The threat type is confirmed as brand impersonation, with the domain remaining active as of the latest verification. Infrastructure analysis reveals multiple technical indicators supporting the fraudulent nature of this domain. The site is hosted on IP address 188.114.97.3, associated with Cloudflare, Inc. (AS13335), and secured by an SSL certificate issued by SSL Corporation / Cloudflare TLS Issuing ECC CA 3. The domain was registered on May 26, 2025, through Cloudflare, Inc., and has been flagged by 2 of 95 security vendors on VirusTotal. Additionally, it appears on one security blocklist, specifically PhishDestroy, further corroborating its malicious classification. These data points collectively establish a pattern consistent with coordinated brand impersonation efforts. Given the current active status and confirmed threat indicators, users are strongly advised to avoid interacting with kraken-mirrors.pages.dev. Security teams should prioritize blocking this domain at the network level, particularly via DNS filtering or firewall rules targeting the resolved IP address. Organizations should also monitor for similar impersonation attempts leveraging Cloudflare-hosted subdomains, as this infrastructure is frequently exploited for phishing and fraud campaigns. End-users are reminded to verify official domains directly through trusted sources before engaging with any cryptocurrency-related services.