krakenpromo-cc[.]pages[.]dev

On July 25 2026, analysis indicates that the domain krakenpromo-cc.pages.dev is associated with a high‑risk brand‑impersonation campaign targeting Kraken users. The site was registered on February 21 2026 via Cloudflare, Inc., and uses Cloudflare’s DNS infrastructure (abdullah.ns.cloudflare.com, surina.ns.cloudflare.com). DNS resolution points to IP 172.66.46.248, which belongs to AS13335 Cloudflare, Inc. in the United States. The web server presents HSTS and HTTP/3 support, and the TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint.

Google Safe Browsing classifies the URL as social engineering, and ten of ninety‑three VirusTotal scanners have flagged the domain, indicating malicious activity. PhishDestroy has blocked the site, and it appears on one external security blocklist. The HTTP response currently returns 403, and the domain is reported as taken offline. The page title observed, "Купоны Кракен — активация, продажа и использование", aligns with a crypto‑scam narrative and directly references the Kraken brand, confirming the impersonation intent.

Gridinsoft’s trust score of 0/100 further underscores the lack of legitimacy. Uncertainty remains regarding the exact payload or phishing landing page because the site is offline and no visual content has been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration or similar sub‑domains, and educate Kraken users about unsolicited coupon offers referencing "Kraken" that request activation or payment. Threat intelligence feeds should be updated to include the domain and its associated IP address.