krakenqr-net[.]pages[.]dev

PhishDestroy identifies krakenqr-net.pages.dev as an active crypto drainer impersonating the legitimate cryptocurrency exchange Kraken. The domain leverages Cloudflare's Pages.dev platform to host a fraudulent QR code generator interface, likely designed to trick users into scanning malicious QR codes that siphon cryptocurrency funds from their wallets. This domain has been explicitly flagged by Google Safe Browsing for social engineering tactics, which often involve misleading users into connecting their wallets or entering sensitive data under the guise of legitimate services. This domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating widespread recognition of its malicious nature. It resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services to appear legitimate. Additionally, krakenqr-net.pages.dev has been blocked by MetaMask, a popular cryptocurrency wallet extension, and appears on at least one security blocklist, further corroborating its malicious intent. Users who have visited krakenqr-net.pages.dev should immediately disconnect any connected cryptocurrency wallets from the site and revoke any permissions granted to suspicious domains. Clear browser cache and cookies related to the domain, and consider running a full antivirus scan. Report the domain to your wallet provider and security teams if you suspect any unauthorized transactions. Stay vigilant for similar brand impersonation attempts, especially those involving cryptocurrency platforms.