9be50d2b[.]ajkevmslay[.]pages[.]dev

Analysis of 9be50d2b.ajkevmslay.pages.dev shows the domain was created on February 21, 2026 and is hosted behind Cloudflare's network (ASN 13335, United States). DNS resolution points to IP address 188.114.97.3, which is owned by Cloudflare, Inc. The site is currently offline and returns a generic "Suspected phishing site | Cloudflare" page title, indicating that the content was either taken down or intercepted by Cloudflare's protective services. No SSL certificate is associated with the host, confirming the absence of HTTPS encryption. Reputation data reveals that the domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service.

VirusTotal scans have returned nine positive detections out of ninety‑five submitted security vendors, reinforcing the suspicion of malicious activity. Registration was performed through Cloudflare, Inc., suggesting the attacker leveraged Cloudflare's free or low‑cost domain services to mask the true infrastructure. Uncertainties remain regarding the specific brand or service the phishing campaign targeted, as the available page title does not disclose a victim brand and no additional payload or URL paths have been observed. Defenders should immediately add 9be50d2b.ajkevmslay.pages.dev to network deny lists, enforce blocking of its resolving IP 188.114.97.3, and monitor for any future resolutions to new IPs under the same ASN.

Continuous vigilance on Cloudflare‑originated domains, especially newly registered ones, is advised. Updating intrusion detection signatures to flag the exact domain name and its associated IP will reduce exposure. Organizations employing outbound filtering should also consider referencing the PhishDestroy blocklist to capture this indicator automatically.