sso-krakenn-com[.]pages[.]dev

Analysis of the domain sso-krakenn-com.pages.dev indicates a targeted brand impersonation campaign against Kraken, a cryptocurrency exchange. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is hosted on Cloudflare infrastructure, resolving to the IP address 188.114.96.3 (AS13335, United States). The SSL certificate is issued by Google Trust Services (WE1), a common feature of Cloudflare-hosted sites, which does not inherently indicate malicious intent but is consistent with phishing infrastructure leveraging legitimate CDN services. The domain is flagged by 14 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist, specifically PhishDestroy. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious.

The HTTP status returned is 403 (Forbidden), and the page title displayed is 'Suspected phishing site | Cloudflare,' suggesting that Cloudflare’s automated systems or manual review may have intervened to restrict access. The domain’s nameservers (lilyana.ns.cloudflare.com and ned.ns.cloudflare.com) are consistent with Cloudflare’s standard configuration. Infrastructure analysis reveals the use of HTTP/3 and HSTS, technologies often employed to enhance security and performance but also utilized by threat actors to lend credibility to phishing sites. The scam type is classified as a crypto scam, aligning with the impersonation of Kraken. While the exact content of the site is not analyzed, the combination of brand impersonation, low trust scores, and blocklist inclusion strongly suggests an attempt to harvest cryptocurrency credentials or facilitate fraudulent transactions.

Defenders should treat this domain as compromised and maintain its inclusion on blocklists.