auth-krakeen-divace[.]pages[.]dev

This domain, auth-krakeen-divace.pages.dev, operates as a credential harvesting phishing site designed to mimic legitimate authentication portals. Analysis indicates the infrastructure targets users attempting to log into cloud-based services or enterprise applications, capturing entered credentials through fraudulent input forms. The site employs social engineering tactics, including cloned branding and urgent login prompts, to deceive victims into disclosing sensitive account information. Technical indicators confirm the domain's malicious nature. The domain resolves to IP address 172.66.47.65, hosted on Cloudflare's network (AS13335), and was registered through Cloudflare, Inc. on February 21, 2026. VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing and one additional security blocklist have classified it as phishing. The SSL certificate, issued by Google Trust Services (WE1), further corroborates the site's attempt to appear legitimate through encrypted connections. Users who visited auth-krakeen-divace.pages.dev or entered credentials should immediately revoke any submitted information. Compromised accounts require password resets, and multi-factor authentication should be enabled where available. Network administrators are advised to block the domain and its resolving IP (172.66.47.65) at the perimeter level. Monitoring for unauthorized access attempts or anomalous login activity is critical, particularly for accounts associated with the targeted services. The domain's current offline status does not eliminate risk, as harvested credentials may still be exploited.