kraken[.]pages[.]dev

kraken.pages.dev is a brand impersonation phishing domain targeting the Kraken cryptocurrency exchange. The page is designed to replicate Kraken login interfaces and is assessed as a credential harvesting endpoint aimed at capturing user authentication data. The site remains active and continues to serve phishing content under a trusted CDN-hosted subdomain structure, increasing its ability to bypass basic reputation filters.

Technical indicators confirm malicious classification: the domain is flagged by 11 of 95 VirusTotal security vendors. It is registered through Cloudflare, Inc., and resolves to IP 188.114.97.3 located in US infrastructure (AS13335 Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1). The domain was created on May 20, 2021 and appears on 1 security blocklist. Google Safe Browsing also marks the domain as phishing, and it is actively blocked by PhishDestroy.

The domain remains active, indicating ongoing exposure risk for users who encounter it via phishing links or social engineering campaigns. Users who interacted with the page should assume credential compromise risk and immediately change any reused passwords, enable multi-factor authentication, and review account activity on the legitimate Kraken platform. Security teams should enforce blocking at DNS and web proxy layers and monitor for similar pages under the pages.dev infrastructure. The combination of 11/95 detections and Safe Browsing confirmation indicates sustained malicious consensus across independent threat intelligence sources.