kocuin-login[.]pages[.]dev

Analysis of kocuin-login.pages.dev indicates that the domain was registered on April 06, 2026 through Cloudflare, Inc. and is served from Cloudflare’s network (IP 172.66.44.108, located in Canada). The domain resolves to Cloudflare’s edge infrastructure using the authoritative nameservers molly.ns.cloudflare.com and sonny.ns.cloudflare.com. A Google Trust Services / WE1 SSL certificate is present, but the HTTP response returns a 403 status code and the page title is “Suspected phishing site | Cloudflare”. The site has been classified as a credential phishing campaign and is currently taken offline.

Reputation data show that the domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal scans report that eight of ninety‑four security vendors flagged the domain, reinforcing the suspicion. No additional public threat‑intel feeds such as OTX are referenced in the available data.

The evidence confirms that the domain is being used to host a credential‑phishing landing page, although the specific target brand or service is not disclosed in the collected artefacts. The presence of a valid SSL certificate does not imply legitimacy, and the 403 response likely results from Cloudflare’s protective controls rather than a benign error. Defenders should continue to block the domain at perimeter filters, add the IP address and hostnames to URL filtering and intrusion‑prevention rule sets, and monitor for any re‑registration or emergence of similar subdomains under the pages.dev namespace. Ongoing observation of Cloudflare‑issued certificates and DNS records is recommended, and deeper analysis of any associated traffic logs may uncover additional infrastructure components linked to the campaign.