en-kraken-darknetsite-net[.]pages[.]dev

Analysis of the domain en-kraken-darknetsite-net.pages.dev, observed on 25 July 2026, indicates a high‑risk brand‑impersonation campaign targeting Kraken users. The domain was registered on 2 September 2020 through Cloudflare, Inc., and is hosted on Cloudflare’s network (ASN 13335) with the IP address 172.66.44.169 located in the United States. TLS termination is provided by a Google Trust Services certificate (WE1), and the site advertises HTTP/3 and HSTS support, suggesting a modern web stack. An HTTP request returns a 403 status code, and the page title captured reads “Kraken маркетплейс сайт вход | ссылка на сайт площадка Kraken”, confirming the intent to mimic Kraken’s marketplace login interface. VirusTotal records show that 11 of 93 scanned security vendors flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat.

The domain appears on a single external blocklist and has been actively blocked by PhishDestroy. Independent scoring by Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The campaign is categorized as a crypto scam, consistent with the brand‑impersonation objective. Evidence confirms the use of Cloudflare’s infrastructure and a legitimate‑looking SSL certificate, which can aid evasion of naive certificate checks.

However, the exact phishing kit, command‑and‑control endpoints, or victim interaction flow remain unknown because the site is currently offline and only a 403 response is observable. No additional intelligence such as malware samples or phishing email artifacts has been disclosed. Defenders should update URL filtering and domain reputation services to block en‑kraken‑darknetsite‑net.pages.dev, enforce strict TLS pinning for Kraken‑related domains, and monitor for similar Cloudflare‑hosted subdomains that reference Kraken in their page titles.