web-krken-enus--logiin[.]pages[.]dev

On July 24, 2026 the domain web-krken-enus--logiin.pages.dev was observed hosting a credential phishing page. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, indicating that the site is currently inaccessible. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., with authoritative nameservers arya.ns.cloudflare.com and cesar.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, confirming the use of standard public‑key infrastructure.

Infrastructure analysis shows that the host supports HTTP/3, enforces HSTS, and is fully proxied by Cloudflare, a common pattern for fast‑deployed phishing infrastructure. Reputation checks reveal a Gridinsoft trust score of 0 out of 100 and a detection by one external blocklist, specifically PhishDestroy, which has already taken the domain offline. VirusTotal scans show that ten of ninety‑three security vendors flagged the domain as malicious, reinforcing the suspicion of phishing activity. The observed evidence aligns with the classified scam type of credential phishing, though no specific target brand or credential collection page content is available from the collected data.

Uncertainty remains regarding the exact phishing template, payload, or victim interaction details because the site is no longer reachable and no visual or form analysis has been performed. Defenders are advised to continue blocking the domain at network perimeter devices, update URL filtering rules to include the observed host, and monitor for any other subdomains that resolve to the same Cloudflare IP range. Additionally, security teams should consider adding the IP address 188.114.96.