diff --git a/content/kiro-device-auth-page.js b/content/kiro-device-auth-page.js
index 1b4de7b..d401660 100644
--- a/content/kiro-device-auth-page.js
+++ b/content/kiro-device-auth-page.js
@@ -5,6 +5,7 @@ const KIRO_CONTINUE_TEXT_PATTERN = /continue|继续/i;
 const KIRO_CONFIRM_CONTINUE_TEXT_PATTERN = /confirm and continue|确认并继续/i;
 const KIRO_ALLOW_ACCESS_TEXT_PATTERN = /allow access|允许访问/i;
 const KIRO_SUCCESS_TEXT_PATTERN = /authorization successful|you may now close this window|you are now signed in|授权成功|可以关闭此窗口|已登录/i;
+const KIRO_CLOUDFRONT_403_TEXT_PATTERN = /403 error|the request could not be satisfied|generated by cloudfront/i;
 
 const KIRO_EMAIL_INPUT_SELECTOR = [
   'input[placeholder="username@example.com"]',
@@ -191,9 +192,53 @@ function findAuthorizationActionButton() {
   });
 }
 
+function detectKiroFatalPageState(pageText = '', currentUrl = '', pageTitle = '') {
+  const combinedText = `${pageTitle} ${pageText}`.replace(/\s+/g, ' ').trim();
+  const normalizedHost = String(location.hostname || '').trim().toLowerCase();
+  const isAwsProfileHost = normalizedHost === 'profile.aws.amazon.com'
+    || normalizedHost === 'profile.aws'
+    || normalizedHost.endsWith('.profile.aws.amazon.com')
+    || normalizedHost.endsWith('.profile.aws');
+  const matchedSignals = [
+    /403 error/i.test(combinedText),
+    /the request could not be satisfied/i.test(combinedText),
+    /generated by cloudfront/i.test(combinedText),
+  ].filter(Boolean).length;
+
+  if (matchedSignals >= 2 || (isAwsProfileHost && matchedSignals >= 1 && KIRO_CLOUDFRONT_403_TEXT_PATTERN.test(combinedText))) {
+    return {
+      state: 'cloudfront_403_page',
+      url: currentUrl,
+      fatalMessage: 'Kiro 注册页返回 403（CloudFront 拒绝请求），通常是当前代理/IP/区域触发了 AWS 风控，请更换代理后重试。',
+    };
+  }
+
+  return null;
+}
+
+function isKiroFatalState(state = '') {
+  return state === 'cloudfront_403_page';
+}
+
+function getKiroFatalStateMessage(snapshot = {}) {
+  if (snapshot?.fatalMessage) {
+    return snapshot.fatalMessage;
+  }
+  switch (snapshot?.state) {
+    case 'cloudfront_403_page':
+      return 'Kiro 注册页返回 403（CloudFront 拒绝请求），通常是当前代理/IP/区域触发了 AWS 风控，请更换代理后重试。';
+    default:
+      return `Kiro 页面出现异常状态：${snapshot?.state || 'unknown'}`;
+  }
+}
+
 function detectKiroPageState() {
   const pageText = getKiroPageText();
   const currentUrl = location.href;
+  const fatalState = detectKiroFatalPageState(pageText, currentUrl, document.title || '');
+  if (fatalState) {
+    return fatalState;
+  }
 
   const passwordInputs = findVisiblePasswordInputs();
   const confirmPasswordInput = findVisibleConfirmPasswordInput();
@@ -274,6 +319,9 @@ async function waitForKiroState(predicate, options = {}) {
   while (Date.now() - start < timeoutMs) {
     throwIfStopped();
     const detected = detectKiroPageState();
+    if (isKiroFatalState(detected.state)) {
+      throw new Error(getKiroFatalStateMessage(detected));
+    }
     if (predicate(detected)) {
       return detected;
     }
@@ -281,6 +329,9 @@ async function waitForKiroState(predicate, options = {}) {
   }
 
   const finalState = detectKiroPageState();
+  if (isKiroFatalState(finalState.state)) {
+    throw new Error(getKiroFatalStateMessage(finalState));
+  }
   throw new Error(options.timeoutMessage || `等待 Kiro 页面状态超时：${finalState.state}`);
 }