logs-krken-docs[.]pages[.]dev

The domain logs-krken-docs.pages.dev has been identified as a credential harvesting phishing site. Analysis indicates this infrastructure was specifically designed to impersonate legitimate authentication portals, tricking users into submitting login credentials. The domain is currently offline, though prior activity suggests it was actively targeting users before takedown. Infrastructure analysis reveals the domain was registered on November 04, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.203 (AS13335, United States). Security vendors detected malicious activity with 16 of 95 VirusTotal engines flagging the domain. It appears on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing domains leveraging legitimate certificate authorities to appear trustworthy. The domain has been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to block the domain and associated IP (172.66.44.203) at the network perimeter. Security teams should review logs for connections to this domain or IP, particularly from November 4, 2025, onward. Users who entered credentials on this site should reset passwords immediately and enable multi-factor authentication where available. Monitoring for related domains using similar naming patterns (e.g., 'krken', 'logs-docs') is recommended.