telvora-nqx-zarqumi-a1x4dp37[.]pages[.]dev

The domain telvora-nqx-zarqumi-a1x4dp37.pages.dev is currently flagged as a generic phishing infrastructure. DNS resolution returns the IPv4 address 172.66.46.230, an address that is hosted on a cloud provider commonly used for short‑lived malicious services. The domain appears on a single public blocklist and is explicitly listed by the PhishDestroy sink‑hole as blocked, indicating that at least one threat‑intel feed has observed malicious activity associated with it. VirusTotal records show that the domain was submitted to 91 scanning engines; none of the engines have raised a detection at the time of analysis.

The absence of detections does not constitute evidence of benign behavior, especially given the active blocklist entry and phishing classification. The available intelligence does not include a page title, SSL certificate details, HTTP response codes, or any observed payload. Consequently, the exact content served by the site remains unverified, and the specific phishing lure (e.g., credential harvesting, account takeover) cannot be confirmed beyond the generic classification. The risk level is marked as “under investigation” and the operational status is “active”, suggesting that the infrastructure may still be in use.

Defenders should prioritize adding the domain to local DNS blocklists and ensure that any outbound connections to 172.66.46.230 are denied or redirected to a sinkhole. Continuous monitoring of DNS query logs for this FQDN and the associated IP address is recommended to detect potential exploitation attempts. Re‑scanning the domain with URL‑analysis services and revisiting the blocklist status in the coming days will help refine the risk assessment as additional telemetry becomes available.