krakenmarket-net-aes[.]pages[.]dev

PhishDestroy identifies the domain krakenmarket-net-aes.pages.dev as an active brand impersonation threat currently under investigation. The site masquerades as Kraken, a legitimate cryptocurrency exchange, aiming to deceive users into divulging sensitive credentials or financial data. This tactic is consistent with credential harvesting and fraudulent transaction schemes observed in similar campaigns.

This domain was flagged by 0 of 95 VirusTotal vendors as of the latest scan, indicating a low detection rate despite clear malicious intent. The domain is registered through Cloudflare, Inc., resolves to IP address 172.66.47.128, and operates under a Google Trust Services SSL certificate, which may contribute to a false sense of legitimacy. Notably, the domain leverages the .pages.dev top-level domain, a service associated with Cloudflare Pages, which is frequently exploited by threat actors to host malicious content. Current intelligence suggests the domain is newly active, with no prior blocklist entries recorded in open-source threat feeds.

Given the active status and undetected nature of this domain, users and organizations are strongly advised to block krakenmarket-net-aes.pages.dev at the network perimeter. Implement DNS sinkholing or firewall rules to prevent access, and ensure endpoint monitoring for any signs of compromise. If this domain has been accessed, instruct users to change passwords immediately, enable multi-factor authentication on all accounts, and conduct a forensic review of endpoints for unauthorized access. Report indicators to relevant threat intelligence platforms to enhance collective defense. The unique seed identifier for this advisory is cba08d.