transferbitcoinkraken[.]pages[.]dev

Transferbitcoinkraken.pages.dev was registered on 21 February 2026 via Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.140 (AS13335, United States). The site presented the page title “Suspected phishing site | Cloudflare” and served an HTTP 403 response while enforcing HSTS and HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 CA, confirming the use of a legitimate certificate chain. The domain is listed on three public blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal recorded three detections out of ninety‑three scanned engines, and Gridinsoft assigned a trust score of 0 / 100, indicating a high confidence of malicious intent. The infrastructure is hosted entirely on Cloudflare’s network, using the nameservers michelle.ns.cloudflare.com and david.ns.cloudflare.com. The only explicitly identified threat vector is a crypto‑related scam that impersonates the Kraken brand, as indicated by the “brand target” field.

No additional payload or content analysis is available because the site is currently offline and the page content beyond the title has not been captured. Defenders should add the domain to deny‑list rules, monitor the associated IP range for re‑use, and ensure that any outbound requests to Cloudflare‑hosted addresses matching this fingerprint are inspected. Continuous threat‑intel feeds should be consulted for potential re‑registration, and endpoint security policies must be updated to flag any attempted connections to this domain or its IP address.