kraken-338[.]pages[.]dev

PhishDestroy identifies kraken-338.pages.dev as an active brand-impersonation domain targeting Kraken cryptocurrency exchange users. This page is a suspected crypto-drainer designed to mimic Kraken’s branding and trick visitors into connecting wallets or entering credentials under false pretenses. The infrastructure leverages Cloudflare Pages for fast deployment and evasion, while the phishing content is tailored to Kraken’s UI and user workflows, increasing the likelihood of successful deception.

This domain was flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category and remains unflagged on VirusTotal with a 13/95 detection rate as of current intelligence. Registered via Cloudflare, Inc., it resolves to IP 188.114.96.3 and is secured with a Google Trust Services SSL certificate. The domain appears on one security blocklist and is actively blocked by MetaMask, indicating early-stage recognition by security tools. While the creation date is not specified in available data, the domain is currently active and operational.

As of this report, kraken-338.pages.dev is categorized as 'under investigation' with an 'active' status and elevated risk due to confirmed impersonation and blockchain targeting. MetaMask has already implemented a block, and the domain is flagged by Google Safe Browsing, reducing exposure to most users. However, the low VirusTotal detection rate and Cloudflare hosting suggest this threat may evolve or spread before full remediation. Users are strongly advised to avoid interacting with this domain, verify all URLs via official Kraken channels, and report any suspicious links to security teams or browser vendors. Remaining risk is moderate due to active evasion tactics and limited detection coverage.