logi-krakken-web[.]pages[.]dev

The domain logi-krakken-web.pages.dev was created on February 21, 2026 and is currently listed as offline, returning an HTTP 403 status code. The site’s page title is recorded as "Suspected phishing site | Cloudflare," indicating that Cloudflare’s protective blockpage has been triggered. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The DNS configuration uses Cloudflare’s authoritative nameservers ben.ns.cloudflare.com and ada.ns.cloudflare.com, confirming that the domain is registered through Cloudflare, Inc. TLS termination is provided by a Google Trust Services certificate (WE1), and the site enforces HSTS while supporting HTTP/3, reflecting modern security features despite its malicious classification.

Threat intelligence flags the domain as a credential phishing site. It appears on one security blocklist and is specifically blocked by PhishDestroy. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that 14 of 93 security vendors have identified it as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment. No additional content analysis is available because the site is taken offline, so the exact phishing payload or targeted brand cannot be confirmed at this time.

Defenders should continue to block the domain at network perimeter devices and update URL filtering rules to include the observed IP address and associated Cloudflare nameservers. Monitoring for any re‑activation or changes to the DNS records is advised, as threat actors may attempt to resurrect the site under a new certificate or alternate sub‑domain. Incident response teams should also correlate any credential harvesting events with the domain creation date and the observed blocklist entries to identify potential victims.