krbus-cc[.]pages[.]dev

PhishDestroy identifies krbus-cc.pages.dev as a live brand-impersonation domain targeting Kraken users. The page masquerades as a guerrilla-marketing campaign featuring a bus and van on Arbat Street in Moscow, leveraging the authentic Kraken brand to lure visitors into fake promotions or malware downloads. The domain uses Cloudflare’s infrastructure, resolving to IP 188.114.97.3 under a Google Trust Services SSL certificate, which gives it an air of legitimacy while concealing its true origin. This domain remains under active investigation and currently shows zero detections on VirusTotal out of 95 engines, indicating it has not yet been widely blacklisted despite clear impersonation signals. Registrant details are obscured via Cloudflare, Inc., and the page title—Kraken автобус на Арбате и фургон с рекламой — partisan marketing—explicitly abuses Kraken’s name in Russian-language content. The combination of zero AV detection, high-risk hosting, and direct brand misuse heightens the risk of credential theft, malware deployment, or financial fraud targeting unsuspecting cryptocurrency users. If you visited krbus-cc.pages.dev, assume your device may have been exposed to malicious scripts or phishing forms. Do not enter any credentials, wallet seeds, or payment details. Clear browser cache and cookies, run a full antivirus scan, and avoid interacting with any future links from this domain. Report the site to Kraken’s abuse team and to Google Safe Browsing to help accelerate its takedown.