en-kraiken-home[.]pages[.]dev

The domain en-kraiken-home.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335, United States). DNS resolution points to 172.66.47.172 and the authoritative name servers are ines.ns.cloudflare.com and rodrigo.ns.cloudflare.com. The site presented the page title “Suspected phishing site | Cloudflare” and the SSL certificate is issued by Google Trust Services under the WE1 classification, confirming that TLS termination is performed by Cloudflare’s edge. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal records show 11 of 93 security vendors labeling it malicious, while Gridinsoft assigns a trust score of 0 / 100.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service. HTTP responses return a 403 status, indicating that the page is currently inaccessible and the operator has taken the site offline. The intelligence categorises the activity as credential phishing, consistent with the observed page title and the safe‑browsing flag. While the technical footprint is well documented, no additional indicators such as payload samples, phishing email artifacts, or victim reports have been made public, leaving the exact targeting vector uncertain.

Defenders should add the domain and its resolved IP address to block lists, enforce outbound filtering to prevent connections to 172.66.47.172, and monitor for any re‑use of the same name servers or TLS certificate fingerprint. Updating email security gateways with the Google Safe Browsing and PhishDestroy feeds will capture any future attempts that reference this host. Continuous telemetry from threat‑intel platforms should be reviewed for re‑appearance of the domain or related aliases.