learn-kreken[.]pages[.]dev

The domain learn-kreken.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.44.89, which is associated with AS13335 in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, indicating that access is currently blocked. Infrastructure analysis shows the presence of HSTS, Cloudflare edge services, and HTTP/3 support, while the TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid SSL chain. The domain appears on a single security blocklist—PhishDestroy—and has been flagged by six of ninety‑three VirusTotal scanners, reinforcing its malicious classification.

Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a lack of reputation. Nameservers aisha.ns.cloudflare.com and nicolas.ns.cloudflare.com are standard Cloudflare delegations, offering no additional attribution. The known scam type is credential phishing, though the specific target brand or login page has not been disclosed.

Defenders should immediately block traffic to the domain at network perimeter devices, update URL filtering rules to include the domain and its resolving IP, and monitor for any attempted connections from internal hosts. Because the site is currently offline, ongoing observation is advised to detect any re‑appearance or use of alternative hosting. Threat intelligence feeds should be updated to reflect the domain's status and its association with Cloudflare infrastructure, and incident response teams should treat any related credential harvest attempts as compromised, prompting credential rotation and user awareness alerts.