krakenpwa-com[.]pages[.]dev

Analysis indicates that the domain krakenpwa-com.pages.dev resolves to IP 188.114.96.3, hosted on Cloudflare's AS13335 network in the United States. The site was created on 21 February 2026 and is registered through Cloudflare, Inc., using the nameservers gannon.ns.cloudflare.com and paislee.ns.cloudflare.com. HTTP requests return a 403 status code and the page title presented by Cloudflare reads "Suspected phishing site | Cloudflare", indicating that the content has been flagged by the provider. The TLS certificate is issued by Google Trust Services under the WE1 profile, confirming the use of valid HTTPS. Security telemetry shows the domain is listed on one blocklist, has a Gridinsoft trust score of 0 out of 100, and is blocked by PhishDestroy.

Google Safe Browsing categorises the URL as a social engineering threat. VirusTotal scans report that 11 out of 95 scanned engines flagged the domain, reinforcing the malicious assessment. The domain is explicitly noted to impersonate the cryptocurrency exchange Kraken and is classified as a crypto‑scam. The presence of HSTS, Cloudflare and HTTP/3 indicates modern infrastructure but does not mitigate the malicious intent.

At the time of reporting (24 July 2026) the site is taken offline, yet the infrastructure artifacts remain observable. Defenders should continue to block the domain at network perimeter, update URL filtering feeds with the observed indicators, and monitor for any re‑use of the underlying IP address or Cloudflare account in future campaigns. Because the site is already offline, evidence collection should focus on preserving DNS query logs, TLS handshake records, and any cached page snapshots for forensic correlation. No further technical details about the payload or credential harvesting mechanism are currently available.