portal-kracken-auth[.]pages[.]dev

The domain portal-kracken-auth.pages.dev was registered on February 21 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.45.6, which belongs to AS13335 Cloudflare, Inc. in the United States. The site is protected by Cloudflare’s edge services, presenting HSTS and HTTP/3 support, and serves a certificate issued by Google Trust Services under the WE1 root. When accessed, the server returns HTTP 403, and the page title reported by the host is “Suspected phishing site | Cloudflare.” The domain is currently offline, and the page is flagged as a credential‑phishing site. Reputation data shows a Gridinsoft trust score of 0 / 100 and a detection by 13 of 93 VirusTotal scanners, indicating multiple security vendors consider the host malicious.

It appears on a single security blocklist and is explicitly blocked by PhishDestroy. Nameservers listed are kimora.ns.cloudflare.com and thomas.ns.cloudflare.com. Analysis indicates the infrastructure is typical of abuse‑hosted domains that leverage Cloudflare’s DNS and CDN to hide origin details while presenting a legitimate‑looking SSL certificate. The combination of a zero trust score, multiple vendor flags, and blocklist inclusion points to an elevated risk of credential harvesting.

However, the offline status limits immediate observation of payload delivery, and no content beyond the page title has been captured, leaving the exact phishing lure unknown. Defenders should add portal‑kracken‑auth.pages.dev to block lists at the network perimeter and DNS filtering layers, monitor outbound connections to the 172.66.45.6 address, and enforce credential‑stealing detection rules for any authentication attempts targeting services that may be mimicked by this domain. Incident response teams should also review logs for any prior access attempts before the takedown and consider sharing the indicator with threat‑intel communities to improve collective detection.