9a44a2aa[.]elvsoo[.]pages[.]dev

This domain, 9a44a2aa.elvsoo.pages.dev, is currently offline but was previously identified as a credential‑phishing site. DNS resolution points to the Cloudflare edge address 172.66.45.22, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain was created on 02 September 2020 and is registered through Cloudflare, Inc., using the authoritative nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com. HTTPS is served with a Google Trust Services certificate (WE1) and the site advertised HTTP Strict Transport Security and HTTP/3 support, indicating a modern web stack. When accessed, the server returned HTTP 403, suggesting that the content is no longer publicly reachable.

Reputation data shows that Google Safe Browsing has classified the site as a social‑engineering threat, and PhishDestroy has actively blocked it. The domain appears on one external security blocklist. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme risk. VirusTotal analysis recorded 11 detections out of 93 scanned scanners, confirming malicious intent.

The page title returned by the server was "Suspected phishing site | Cloudflare", which aligns with the credential‑phishing classification. Uncertainty remains regarding the specific credential targets and any payload delivered before takedown, as no detailed page content was captured. Analysts should continue to monitor the associated IP address for any reuse, enforce blocklisting of 172.66.45.22 in perimeter defenses, and ensure that endpoint protection solutions ingest the VirusTotal detection identifiers. Organizations should also verify that users are educated about unsolicited login prompts and that multi‑factor authentication is enforced to mitigate credential‑phishing attempts originating from this infrastructure.