app-pro-kraken[.]pages[.]dev

app-pro-kraken.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP address 188.114.97.3 (AS13335, United States). The domain is served behind Cloudflare’s edge network, presents an HSTS header, and uses HTTP/3. The TLS certificate is issued by Google Trust Services (WE1), indicating a valid HTTPS endpoint. Automated probes return HTTP 403 and the page title is "Suspected phishing site | Cloudflare", a generic block page supplied by Cloudflare when the site is taken down. Scamadviser assigns a trust score of 1 / 100 and Gridinsoft 0 / 100, reflecting extreme reputational risk.

The site appears on one external blocklist and is listed by PhishDestroy. Google Safe Browsing flags the domain for social‑engineering content, and VirusTotal reports that 14 of 93 scanned scanners flag the domain as malicious. The domain is classified as a “Crypto Scam” and explicitly impersonates the cryptocurrency exchange Kraken. Nameservers zeus.ns.cloudflare.com and emerie.ns.cloudflare.com are standard Cloudflare delegations. Evidence confirms that the infrastructure is fully hosted on Cloudflare, and the low trust scores together with multiple vendor detections indicate a high‑confidence malicious operation targeting Kraken customers.

However, the offline status and 403 response mean that active content cannot be examined, leaving the exact payload and credential‑capture mechanisms unknown. Defenders should add the domain and its IP address to internal blocklists, monitor for any DNS queries to the associated Cloudflare nameservers, and enforce URL filtering for the Kraken brand. Security tools that integrate Google Safe Browsing, PhishDestroy, and VirusTotal should be configured to raise alerts on future resolutions of this domain. Because the domain is hosted on a shared Cloudflare network, other tenants may share the same IP, so alerts should be scoped to the fully qualified domain name to avoid false positives.