pro-krkn-loginn[.]pages[.]dev

The domain pro-krkn-loginn.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.96.3 located in the United States under ASN 13335. The authoritative nameservers are tanner.ns.cloudflare.com and fatima.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 response, indicating that access was deliberately denied. TLS termination is provided by a Google Trust Services certificate (issuer "WE1"), and the server advertises HSTS and HTTP/3, confirming the use of modern Cloudflare security features.

Google Safe Browsing categorises the URL as a social‑engineering threat, and VirusTotal records show that 16 of 93 scanning engines flagged the domain as malicious, consistent with a credential‑phishing classification. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. Because the site is currently offline, active exploitation is not observable, but the infrastructure components—Cloudflare hosting, a Google‑issued TLS certificate, and the "Suspected phishing site" page title—are typical of credential‑phishing campaigns that rely on rapid deployment and takedown.

Defenders should continue to block the domain at the DNS layer, ensure that any outbound connections to the IP 188.114.96.3 are denied, and add the domain to internal threat‑intel feeds. Continuous monitoring of Cloudflare‑hosted subdomains for re‑registration or similar naming patterns is recommended, as attackers often reuse the same registration service to launch successor campaigns. Correlation with other incidents that reference the same Safe Browsing or VirusTotal signatures can help identify broader campaign activity.