portal-kraken-auth[.]pages[.]dev

The domain portal-kraken-auth.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.175, which is announced by AS13335 and geolocated to the United States. The site presents the Cloudflare‑generated page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 response, indicating that the request was blocked by Cloudflare’s security controls. The TLS certificate is issued by Google Trust Services under the WE1 root, a common certificate chain for Cloudflare‑hosted assets, and the server advertises HSTS, Cloudflare and HTTP/3 support. The domain is listed as a brand‑impersonation campaign targeting Kraken, and the associated scam type is identified as a crypto scam.

It appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 11 of 93 scanning engines flagged the domain, and the Gridinsoft trust score is 0 / 100, both of which reinforce the malicious assessment. The authoritative nameservers are coco.ns.cloudflare.com and chris.ns.cloudflare.com, confirming Cloudflare’s control of the DNS zone. At the time of writing (24 July 2026) the infrastructure has been taken offline, but the historical evidence suggests that the operator leveraged Cloudflare’s free Pages hosting to craft a short‑lived impersonation site.

No additional content analysis is available beyond the generic block page, and the exact payload or credential‑harvesting mechanisms remain unknown. Defensive teams should continue to block the domain and any future subdomains under pages.dev that resolve to the same IP range, monitor for similar naming patterns that combine “kraken” with authentication terms, and incorporate the observed indicators—HTTP 403, Google Trust Services certificate, the two Cloudflare nameservers, and the 11 / 93 VirusTotal flag count—into their threat‑intel feeds.