ckr-landing-v2[.]pages[.]dev

This domain, ckr-landing-v2.pages.dev, is flagged as a credential theft operation impersonating CKR Exteriors, a commercial roofing contractor based in Atlanta. The page title "CKR Exteriors | Commercial Roofing Atlanta | Free Inspection" directly replicates the legitimate business’s branding to deceive visitors into submitting sensitive information. Analysis indicates no association with cryptocurrency drainer kits or payment diversion schemes; instead, the infrastructure appears designed for harvesting corporate or personal credentials under the guise of a service inquiry. Infrastructure analysis reveals the following technical indicators: the domain currently resolves to IP address 188.114.96.3, hosted on Cloudflare’s network in Canada. It was registered on March 27, 2026, through Cloudflare, Inc., and is secured with an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports 0 detections across 95 engines, suggesting either recent deployment or effective evasion techniques. The domain appears on a single security blocklist, specifically PhishDestroy, while Google Safe Browsing has not yet flagged it. The domain remains active as of this report, with no takedown or sinkholing observed. The low detection rate and minimal blocklist presence indicate a targeted or low-volume campaign, potentially evading broader scrutiny. Organizations and individuals are advised to block the domain at the network level and monitor for credential reuse attempts from users who may have interacted with the fraudulent site. Security teams should correlate this domain with internal logs for potential exposure and prioritize awareness training around brand impersonation tactics in service-based phishing lures.