kraken-darknet-to[.]pages[.]dev

The domain kraken-darknet-to.pages.dev is currently active and classified as a high‑risk brand‑impersonation site targeting the Kraken brand with a crypto‑scam motive. Registration data indicates the domain was created on 2020-09-02 through Cloudflare, Inc., and it resolves to IP address 172.66.47.132, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. DNS resolution uses four Cloudflare nameservers: adi.ns.cloudflare.com, cleo.ns.cloudflare.com, karl.ns.cloudflare.com, and ulla.ns.clou. The site serves HTTPS with a Google Trust Services / WE1 certificate and returns HTTP status 200, employing HSTS and HTTP/3. Observed technologies include Yandex.Metrika, Cloudflare edge services, and HTTP/3 support. Google Safe Browsing has flagged the domain for SOCIAL_ENGINEERING, and it appears on a single security blocklist, where it is blocked by PhishDestroy. VirusTotal analysis shows a single detection out of 93 scanning vendors. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. Defenders should block the domain at network perimeters, add it to endpoint allow‑lists as malicious, and monitor for any traffic to the associated IP range. Continuous watch for new indicators is advised, as the site remains active and may evolve its payload or phishing pages.