kiranexus[.]pages[.]dev

This domain, kiranexus.pages.dev, is flagged as a generic phishing resource targeting users through a credential-harvesting scheme. Analysis indicates the site mimics Cloudflare’s authentication portal, likely designed to capture login credentials, session tokens, or multi-factor authentication codes. No associated drainer kit has been identified at this stage, though the infrastructure aligns with common phishing-as-a-service deployments. The domain’s design and hosting pattern suggest a focus on enterprise or developer targets familiar with Cloudflare’s interface. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 27, 2026, through Cloudflare Pages, a legitimate hosting service often abused for phishing due to its free tier and SSL provisioning. VirusTotal reports 0 detections across 95 engines, indicating the campaign remains undetected by most security vendors. The domain appears on a single security blocklist, specifically PhishDestroy, which has flagged it for malicious activity. No Google Safe Browsing (GSB) listing is present, and passive DNS records show no prior malicious associations. The site resolves to Cloudflare’s Anycast network, obscuring its origin infrastructure. Current status remains active, with no takedown or sinkholing observed. Response actions are limited to blocklist inclusion, though the lack of broader detection suggests the campaign is either new or employs evasion techniques. Remaining risk is elevated due to the domain’s plausible impersonation of a trusted service and its undetected status on most security platforms. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on all accounts, and cross-reference login portals with official documentation. Enterprises should monitor for anomalous authentication attempts originating from this domain or its associated IP ranges.