36e0e9e4[.]mfgjgnihfh[.]pages[.]dev

Analysis of 36e0e9e4.mfgjgnihfh.pages.dev shows a high‑risk credential phishing indicator set. The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States, and it is hosted behind Cloudflare infrastructure with HSTS and HTTP/3 enabled. The SSL certificate is issued by Google Trust Services under the WE1 label, confirming a valid TLS handshake. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting the site is currently inaccessible.

Registration details reveal that the domain was created on September 02, 2020 and was provisioned through Cloudflare, Inc., using the nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com. Threat intelligence flags the site as a credential phishing operation; it appears on one security blocklist and is blocked by PhishDestroy. Google Safe Browsing categorises the domain as social engineering, and Gridinsoft assigns a trust score of 0 out of 100, indicating extreme suspicion. VirusTotal analysis shows that 12 of 93 security vendors have flagged the domain as malicious, reinforcing the phishing classification.

While the technical footprint confirms a Cloudflare‑protected host with a valid certificate, the exact content of the landing page remains unverified beyond the title, leaving the specific credential collection mechanisms unknown. Defenders should treat any traffic to this domain as malicious, enforce blocklisting at perimeter devices, monitor DNS queries for the domain and its IP, and consider adding the address to endpoint denial lists. Continuous observation of Cloudflare‑associated IP ranges for similar patterns is advisable, and any credentials submitted to the domain should be assumed compromised and forced to be reset.