access-krakun-cdn[.]pages[.]dev

The domain access-krakun-cdn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.44.183, which belongs to AS13335 (Cloudflare) in the United States. The site is currently taken offline and returns an HTTP 403 status code; the page title presented by the server is "Suspected phishing site | Cloudflare." TLS negotiation uses a certificate issued by Google Trust Services under the WE1 label, and the connection is protected by HSTS and HTTP/3, indicating modern web stack components. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis shows that 14 of 95 security vendors have flagged the domain, and Google Safe Browsing classifies it as a social engineering threat.

The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy service. Nameservers are ace.ns.cloudflare.com and blakely.ns.cloudflare.com. While the exact phishing target is not disclosed in the available data, the classification as credential phishing suggests attempts to harvest user credentials. Defenders should immediately add the domain to network deny lists, enforce DNS sinkholing, and ensure that endpoint security solutions are updated to reflect the 14 vendor detections.

Continuous monitoring of the IP address 172.66.44.183 for any re‑activation is advised, as Cloudflare‑hosted infrastructure can be repurposed quickly. Correlation with authentication logs for unexpected login attempts from this IP range can help identify compromised accounts. Given the low trust score, presence on multiple threat feeds, and active blocklist entries, the domain should be treated as high‑risk and excluded from any legitimate traffic flows.