kraken-foundation-cc[.]pages[.]dev

Analysis of kraken-foundation-cc.pages.dev shows a high‑risk, active brand‑impersonation campaign targeting the cryptocurrency exchange Kraken. The site was registered on June 5, 2025 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.47.94 in the United States (AS13335). DNS resolution uses the Cloudflare nameservers journey.ns.cloudflare.com and fred.ns.cloudflare.com, and the HTTPS service presents a Google Trust Services / WE1 certificate with HSTS and HTTP/3 enabled. The page title, "Благотворительный фонд Кракен," translates to "Kraken Charity Fund," reinforcing the impersonation of the Kraken brand. VirusTotal records indicate that nine of ninety‑five security vendors have flagged the domain, and Google Safe Browsing classifies it under the SOCIAL_ENGINEERING category. The domain appears on three security blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL, while Gridinsoft assigns a trust score of zero out of one hundred. The observed evidence aligns with a crypto‑scam profile, though the exact content of the page beyond the title has not been publicly disclosed. Defenders should block the domain at network perimeters, update URL filtering rules, and monitor for related phishing attempts leveraging the Kraken brand. Continuous threat‑intel tracking is recommended to detect any infrastructure changes or new payloads associated with this campaign.