access-kraken-en[.]pages[.]dev

access-kraken-en.pages.dev was observed on July 23, 2026 as a site impersonating the cryptocurrency exchange Kraken. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.44.96, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. The site presented the HTML title “Suspected phishing site | Cloudflare” and returned an HTTP 403 status code, indicating that the content is currently blocked. Independent blocklists confirm the malicious nature: the domain appears on one security blocklist and is specifically listed by PhishDestroy.

Reputation services assign extremely low scores, with Gridinsoft scoring 0 / 100 and Scamadviser 1 / 100, and VirusTotal reports that 13 of 93 scanning engines flag the domain as malicious. The TLS certificate is issued by Google Trust Services under the “WE1” identifier, which is typical for Cloudflare‑proxied sites but does not mitigate the observed abuse. Detected technologies include HTTP/3, HSTS, and the Cloudflare CDN, all of which are consistent with the hosting provider. The page title and the “Impersonates: Kraken” label indicate a crypto‑scam vector, although the exact payload or credential‑collection mechanism has not been publicly disclosed.

Because the site is currently offline, real‑time traffic observation is not possible, but the historical evidence suggests a short‑lived phishing infrastructure that leveraged Cloudflare’s free tier to obtain a credible TLS certificate and evade simple URL‑based filters. Defenders should add the domain and its IP address to blocklists, monitor for any resurgence of the same sub‑domain pattern (access‑kraken‑en.pages.dev) or similar “pages.dev” subdomains, and enforce outbound filtering for known Kraken login URLs.