krakeneslogin[.]pages[.]dev

This domain is flagged as a high-risk credential phishing site specifically targeting users of the KuCoin cryptocurrency exchange. Analysis indicates the domain krakeneslogin.pages.dev presents a fraudulent login interface under the page title 'Kucoin Login - Secure Access to Your Crypto Account,' designed to harvest user credentials, two-factor authentication codes, and private wallet keys. The threat type is classified as brand impersonation with direct financial fraud intent, posing immediate risks to user account security and asset integrity. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 13, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.78, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendors on VirusTotal flagged the domain with 11 detections out of 95 engines, while Google Safe Browsing explicitly labels it as phishing. The SSL certificate is issued by Google Trust Services (WE1), a common pattern in phishing campaigns leveraging legitimate certificate authorities to appear trustworthy. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. Mitigation steps should prioritize immediate containment and user awareness. Network administrators are advised to block the domain and its resolving IP (172.66.47.78) at the firewall or DNS level to prevent access. Users who may have interacted with the site should immediately reset their KuCoin credentials, revoke active sessions, and enable enhanced authentication controls such as hardware-based two-factor authentication. Organizations should conduct retrospective log analysis to identify any prior connections to the domain or IP, particularly from endpoints handling cryptocurrency transactions. Given the domain's use of Cloudflare infrastructure, additional scrutiny should be applied to other subdomains under pages.dev or similar hosting patterns, as threat actors frequently reuse infrastructure for multiple campaigns.