koccuin-login[.]pages[.]dev

The domain koccuin-login.pages.dev has been identified as a credential phishing site, currently taken offline after being flagged for malicious activity. This domain was designed to impersonate a login portal, likely targeting users of a popular service, though no specific brand is confirmed in the available intelligence. Cloudflare's own security systems detected the threat, displaying a "Suspected phishing site" warning on the page.

Analysis reveals that 17 out of 95 security vendors on VirusTotal flagged koccuin-login.pages.dev as malicious, and Google Safe Browsing also flags it for phishing. The domain was registered through Cloudflare, Inc., and its SSL certificate was issued by Google Trust Services / WE1. It resolved to IP address 172.66.44.59 and was created on April 06, 2026. Despite appearing on only one security blocklist, the high number of vendor flags and Google's warning indicate significant risk. The domain's current status is offline, thanks to takedown actions.

Users who may have visited koccuin-login.pages.dev should immediately change passwords for any accounts entered there and monitor for unauthorized activity. PhishDestroy strongly advises verifying any site claiming to be a login page, especially those hosted on free or ephemeral domains like pages.dev. As a precaution, enable two-factor authentication and use a password manager to avoid entering credentials on suspicious pages.