kraken-front-epc[.]pages[.]dev

This domain, kraken-front-epc.pages.dev, is flagged as a high-risk brand impersonation threat targeting the cryptocurrency exchange Kraken. The page title 'Kraken Immo' suggests an attempt to mimic legitimate Kraken services, potentially to harvest credentials or deploy crypto-draining malware. No explicit drainer kit signatures have been confirmed, but the infrastructure aligns with known phishing campaigns impersonating financial platforms.

Analysis indicates the domain was registered on May 19, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.152 (US, AS13335 Cloudflare, Inc.). VirusTotal reports 5/95 security vendors detecting malicious activity, while the domain appears on three security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted sites. Google Safe Browsing status is not explicitly listed, but the domain is actively blocked by at least three security providers, including PhishDestroy, MetaMask, and SEAL.

As of the latest assessment, the domain remains active and unresolved by the registrar. Users are advised to treat any interaction with this domain as malicious, particularly if prompted for login credentials or wallet connections. Organizations should update blocklists to include this domain and its associated IP, while monitoring for related infrastructure leveraging the same registrar or hosting patterns. The remaining risk is high due to the domain's operational status and its targeting of cryptocurrency users.