start-krakeen-web[.]pages[.]dev

start-krakeen-web.pages.dev was observed as a credential‑phishing infrastructure. The domain was registered on February 21 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.44.156, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. DNS resolution uses the Cloudflare name servers plato.ns.cloudflare.com and gabriella.ns.cloudflare.com. An HTTPS service is presented with a Google Trust Services / WE1 certificate, and HTTP responses return status 403, indicating that the site is currently inaccessible. The page title returned by the server is “Suspected phishing site | Cloudflare”, matching the classification of a credential‑phishing campaign.

Google Safe Browsing lists the domain for social‑engineering content, and the site appears on one security blocklist. VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy has already blocked the domain. Detected technologies include HSTS, Cloudflare protection, and HTTP/3 support. The risk level is rated high, and the current status is offline.

Evidence confirms the domain’s use for credential harvesting, but the specific target brand or phishing kit has not been disclosed in the available data. Analysts cannot verify the exact payload or the compromised credentials because the site is no longer reachable. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same IP address or name‑server pair, and update detection signatures to include the observed SSL fingerprint and HTTP/3 fingerprint. Ongoing surveillance of Cloudflare‑hosted infrastructure associated with this IP range is recommended, as adversaries frequently recycle edge addresses for new campaigns.