krakentour[.]pages[.]dev

Analysis of krakentour.pages.dev shows a high‑risk, active brand‑impersonation campaign targeting Kraken users. The site presents the page title "Kraken Tour - Discover the World" and is hosted on the IP address 172.66.46.225, which is allocated to a US‑based provider (AS13335). The domain was registered on April 23 2025 and uses the authoritative nameservers brady.ns.cloudflare.com and elly.ns.cloudflare.com. TLS is supplied by a Google Trust Services / WE1 certificate, and the site enforces HSTS while supporting HTTP/3, indicating a modern web stack. HTTP responses return a 200 status code, and the domain appears on a single security blocklist, with PhishDestroy already flagging it. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 / 100, and 10 of 95 VirusTotal scanners have flagged the domain. Google Safe Browsing lists it under the "SOCIAL_ENGINEERING" category, reinforcing the impersonation assessment. While the exact content of the page has not been captured, the available indicators confirm a crypto‑scam vector that pretends to be associated with Kraken. Defenders should immediately block network resolution to krakentour.pages.dev, add the domain to URL filtering policies, and monitor for any outbound connections to the associated IP. Continued threat‑intel sharing and periodic re‑scanning are recommended to capture any evolution of the site’s payload or phishing tactics.