krakenlogin-cc[.]pages[.]dev

Analysis indicates that the domain krakenlogin-cc.pages.dev was registered through Cloudflare on 21 February 2026 and is currently taken offline. The site resolves to the Cloudflare edge address 188.114.96.3, located in the United States and announced by AS13335. The TLS certificate presented is issued by Google Trust Services under the WE1 label, consistent with Cloudflare‑provided HTTPS. DNS resolution uses the Cloudflare‑owned authoritative nameservers and the HTTP response returns a 403 status code, suggesting that the content is intentionally blocked or inaccessible. The page title returned from the HTTP request reads “Suspected phishing site | Cloudflare”, and the brand target is identified as Kraken.

The scam type is classified as a crypto‑related scam. VirusTotal scans show that two of ninety‑three security vendors flagged the domain, and the domain appears on three public blocklists. Additional blocking is observed from PhishDestroy, MetaMask, and SEAL. A Gridinsoft trust score of zero out of one hundred further reflects a lack of legitimacy. Detected technologies include HSTS, Cloudflare CDN, and HTTP/3 support.

Evidence confirms that the domain is being used to impersonate Kraken for cryptocurrency‑related fraud, but the exact payload or credential‑stealing page has not been captured. Because the site is offline, active mitigation is limited to pre‑emptive blocking. Defenders should add the domain and its associated IP address to firewall deny lists, update DNS‑based threat feeds, and monitor for any resurgence under the same nameserver configuration. Continuous observation of Cloudflare‑issued certificates for new subdomains that contain “krakenlogin” is advised, as threat actors often reuse similar naming patterns. Organizations that interact with Kraken services should educate users about unsolicited login prompts and enforce multi‑factor authentication to reduce the impact of potential credential harvesting.