crack-en-login-app[.]pages[.]dev

The domain crack-en-login-app.pages.dev was created on 21 February 2026 and is currently listed as offline. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is registered through Cloudflare, Inc. and uses the authoritative nameservers cortney.ns.cloudflare.com and conrad.ns.cloudflare.com. HTTPS is enforced via HSTS and the presented certificate is issued by Google Trust Services under the WE1 label, indicating a legitimate TLS chain despite the malicious intent of the site. An HTTP request to the host returns a 403 status code, a response commonly observed on takedown or sinkhole pages hosted by Cloudflare.

Google Safe Browsing has flagged the site for social engineering, and the domain appears on a single security blocklist. VirusTotal analysis shows that fifteen of ninety‑three scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. Independent scanning by Gridinsoft assigned a trust score of zero out of one hundred, the lowest possible rating. PhishDestroy has also taken action to block the domain.

The combined evidence—registration timing, Cloudflare hosting, SSL configuration, safe‑browser warning, multi‑vendor detections, and blocklist presence—supports a high‑confidence classification of credential phishing. Uncertainties remain regarding the specific credential targets and any post‑exploitation payloads, as no content analysis or URL path details are available. Defenders should continue to block the domain at network perimeters, update DNS‑based blocking policies, and monitor for any related subdomains or newly registered domains that reuse the same Cloudflare nameservers. Continuous re‑evaluation is advised in case the site reappears under a different IP or certificate, given the ease of re‑deployment on Cloudflare’s platform.