krakn-en-logn[.]pages[.]dev

Analysis of the domain krakn-en-logn.pages.dev indicates a high-risk crypto scam impersonating the Kraken cryptocurrency exchange. The domain, registered on February 21, 2026, was hosted on Cloudflare infrastructure (AS13335) and resolved to the IP address 172.66.44.96, located in the United States. Nameservers bailey.ns.cloudflare.com and clay.ns.cloudflare.com were associated with the domain, further linking it to Cloudflare’s network. At the time of assessment, the domain returned an HTTP 403 status and displayed the page title 'Suspected phishing site | Cloudflare,' suggesting it had been flagged and taken offline by the hosting provider. Security vendors have consistently marked this domain as malicious.

Google Safe Browsing classified it as a social engineering threat, while PhishDestroy blocked access to it. Scamadviser and Gridinsoft assigned trust scores of 1/100 and 0/100, respectively, reflecting near-universal consensus on its fraudulent nature. The domain appears on at least one security blocklist, and 13 of 95 vendors on VirusTotal flagged it as malicious, though the absence of additional context limits deeper analysis of specific detection rules. The SSL certificate, issued by Google Trust Services (WE1), does not provide meaningful trust signals, as fraudulent domains frequently leverage valid certificates to appear legitimate. Technologies detected include HSTS, Cloudflare, and HTTP/3, which are commonly used by both legitimate and malicious sites to enhance performance and security.

The use of Cloudflare’s infrastructure is notable, as it is a preferred hosting provider for threat actors due to its free tier, global CDN, and privacy features that obscure the true origin of the site. While the domain is currently offline, defenders should treat any prior resolution to 172.66.44.96 or association with the listed nameservers as indicators of compromise.