portal-krken-com[.]pages[.]dev

On 25 July 2026, portal-krken-com.pages.dev was identified as a credential‑phishing infrastructure. The domain was registered on 21 February 2026 through Cloudflare, Inc., and is delegated to the Cloudflare nameservers noor.ns.cloudflare.com and roan.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2f36, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site presented the page title “Suspected phishing site | Cloudflare” and responded with HTTP 403, indicating that the content is presently inaccessible; the status field confirms the site has been taken offline.

TLS inspection shows a certificate issued by Google Trust Services under the “WE1” profile, consistent with Cloudflare‑provided SSL termination. HTTP headers reveal the use of HSTS and the service supports HTTP/3, confirming that the hosting environment is fully Cloudflare‑managed. Reputation scoring from Gridinsoft assigns a trust score of 0/100, and the domain appears on a single public blocklist (PhishDestroy). VirusTotal analysis records 14 detections out of 93 scanned engines, reinforcing the malicious classification.

The aggregate evidence aligns with the “Credential Phishing” scam type supplied in the intelligence feed. Uncertainty remains regarding the specific credential collection mechanisms and the target brands, as no page content has been captured and the site is offline. Analysts should continue to monitor the domain for re‑activation, enforce blocks at network perimeters, and add the IPv6 address to indicator‑of‑compromise lists. Coordination with Cloudflare’s abuse team is recommended to request takedown or further forensic data, and organizations should ensure that any credential‑phishing alerts referencing this domain are correlated with the observed indicators.