account-krakeen-io[.]pages[.]dev

The domain account-krakeen-io.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and it resolves to the Cloudflare edge address 172.66.44.83 (AS13335, United States). The authoritative name servers are dylan.ns.cloudflare.com and zoe.ns.cloudflare.com, indicating the site is hosted entirely on Cloudflare’s infrastructure. TLS termination is provided by a Google Trust Services certificate (WE1), and the site enforces HSTS while supporting HTTP/3, confirming the use of modern security protocols despite the malicious intent. An HTTP 403 response is returned for the root request, and the page title reported by the scanner is "Suspected phishing site | Cloudflare," which aligns with the credential‑phishing classification in the intelligence feed.

Reputation metrics are uniformly negative: the site appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows that 12 of 93 scanned engines flagged the domain, reinforcing the suspicion. Independent scoring services assign extremely low trust values—Gridinsoft scores 0 out of 100 and Scamadviser scores 1 out of 100—reflecting a high likelihood of malicious activity.

No additional artifacts such as phishing page content, credential‑stealing kits, or target brand references were observed in the available data; the analysis therefore relies solely on infrastructure and reputation indicators. Defenders should treat the domain as hostile, block DNS resolution and HTTP traffic to the IP address, and add the domain to internal blocklists. Continuous monitoring of Cloudflare‑hosted subdomains is advised, as the provider’s shared infrastructure can be leveraged for rapid redeployment of similar campaigns.