usa-kraken-login[.]pages[.]dev

Analysis as of July 24, 2026 indicates that the domain usa-kraken-login.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the Cloudflare IP address 172.66.47.101, which is owned by AS13335 Cloudflare, Inc. in the United States. The domain is configured with the Cloudflare nameservers mcgrory.ns.cloudflare.com and leanna.ns.cloudflare.com and serves a site protected by HSTS and HTTP/3. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, confirming a valid TLS handshake at the time of observation. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, indicating that access to the page is currently denied. The site has been classified as a crypto‑scam that impersonates the cryptocurrency exchange Kraken, matching the brand target field.

Google Safe Browsing flags the domain for social engineering, and a single security blocklist has listed the domain. PhishDestroy has taken the site offline, and the current status is recorded as offline. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme risk. VirusTotal analysis shows that 13 of 95 antivirus and URL scanning engines flagged the domain, providing independent confirmation of malicious intent.

No additional intelligence such as OTX references or sandbox analysis is available. Given the combination of brand impersonation, a low trust score, multiple vendor detections, and active blocklisting, defenders should treat the domain as high‑risk. Recommended mitigations include adding the domain and its IP address to network deny lists, monitoring for any future re‑registration or changes in DNS resolution, and informing users that any unsolicited communication requesting Kraken credentials is likely fraudulent. Continuous re‑evaluation is advised in case the infrastructure reappears under a different subdomain or hosting configuration.