kraken-log--in[.]pages[.]dev

Analysis indicates that the domain kraken-log--in.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare edge address 172.66.44.193, which is announced by AS13335 and located in the United States. The authoritative nameservers are margot.ns.cloudflare.com and nicolas.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. HTTPS is served with a certificate issued by Google Trust Services under the WE1 intermediate, and the site advertised HTTP Strict Transport Security and HTTP/3 support, suggesting a modern, hardened web stack. When accessed, the server returned HTTP 403, and the page title presented by Cloudflare reads “Suspected phishing site | Cloudflare,” indicating that Cloudflare has already flagged the content as malicious.

Google Safe Browsing has labeled the URL as a social‑engineering threat, and the domain appears on at least one public security blocklist, currently blocked by PhishDestroy. VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. The Gridinsoft trust score is 0 out of 100, the lowest possible rating, and the site is categorised as a “Crypto Scam” that impersonates the cryptocurrency exchange Kraken. The evidence collectively points to a high‑risk brand‑impersonation campaign targeting Kraken users.

However, because the site has been taken offline, no live content or payload can be examined, and the specific phishing kit or credential‑harvesting mechanisms remain unknown. Defenders should update internal blocklists to include kraken-log--in.pages.dev, monitor for any resurgence of the domain or related sub‑domains, and enforce strict email and web‑gateway filtering for communications purporting to originate from Kraken.