io-krraken-login-en[.]pages[.]dev

This domain, io-krraken-login-en.pages.dev, is a confirmed credential phishing site registered on February 21, 2026, and hosted on Cloudflare infrastructure (AS13335). As of July 24, 2026, the domain has been taken offline, returning an HTTP 403 status with a page title explicitly labeled 'Suspected phishing site | Cloudflare.' Analysis indicates the domain was flagged by 13 of 93 security vendors on VirusTotal and appears on a single security blocklist, including PhishDestroy. Google Safe Browsing classifies the domain under 'social engineering,' consistent with credential harvesting activity. The SSL certificate, issued by Google Trust Services (WE1), does not provide additional indicators of compromise beyond standard Cloudflare deployment.

Infrastructure analysis reveals the domain resolves to an IPv6 address (2606:4700:310c::ac42:2f65) and uses Cloudflare nameservers (maleah.ns.cloudflare.com, justin.ns.cloudflare.com). Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. While the domain name suggests an attempt to mimic a cryptocurrency exchange login portal, no direct evidence from the provided data confirms the specific brand targeted or the phishing kit used. The exact content of the phishing page remains unanalyzed, as the domain is currently offline.

Defenders should treat this domain as high-risk for credential theft, particularly in sectors handling cryptocurrency or financial data. Block the domain and its resolving IP at perimeter security controls, and monitor for related subdomains or newly registered lookalike domains under Cloudflare Pages. If internal access logs indicate prior visits, initiate credential reset procedures for affected accounts. No further action is required for this specific domain, as it is no longer active, but retrospective log analysis may reveal earlier compromise attempts.