krakenlogin-cgf[.]pages[.]dev

Analysis as of July 23, 2026 indicates that the domain krakenlogin-cgf.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. The domain resolves to IP 172.66.47.169, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The hosting infrastructure presents HSTS, Cloudflare CDN, and HTTP/3 support, and the TLS certificate is issued by Google Trust Services under the WE1 authority, confirming the use of a legitimate certificate chain. An HTTP request returns a 403 status code, and the page title reported by the server is "Suspected phishing site | Cloudflare". The site is listed on a single security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classifies the URL as a social engineering threat, and VirusTotal records 16 detections out of 95 scanned vendors.

Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The observed scam type is a crypto scam that impersonates the Kraken brand. The domain is currently offline, and the status field confirms it has been taken offline. The available evidence confirms that the domain was deliberately crafted to mimic Kraken’s brand, leveraging a reputable CDN and a valid SSL certificate to increase credibility. The presence of multiple independent detections, the blocklist entry, and the Google Safe Browsing flag provide strong confidence that the site was used for malicious credential harvesting or other crypto‑related fraud.

Uncertainty remains regarding the specific phishing kit or payload delivered, as no content analysis beyond the page title is available. Defenders should continue to block the domain at perimeter firewalls and DNS filters, monitor for any resurgence of the sub‑domain pattern, and ensure that endpoint protection solutions ingest the VirusTotal detection set.