129a2f81[.]ajkevmslay[.]pages[.]dev

This domain is flagged as an active credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates an elevated risk level due to confirmed malicious infrastructure and broad detection across security platforms. The threat type aligns with generic phishing but exhibits characteristics of targeted credential theft, likely impersonating legitimate services to capture sensitive authentication data. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3 (AS13335, Cloudflare, Inc., US), with no SSL certificate present. It was registered through Cloudflare, Inc. on February 21, 2026, though this creation date may reflect a placeholder or misconfiguration. The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, with detection signatures including phishing, fraud, and credential theft. The page title explicitly states 'Suspected phishing site | Cloudflare,' further corroborating its malicious classification. Mitigation steps should include immediate blocking of the domain and its associated IP (188.114.97.3) at the network perimeter. Organizations should deploy email and web filtering rules to prevent user access, particularly for messages containing links to ajkevmslay.pages.dev subdomains. Endpoint protection should be updated to recognize the domain and its hashes, while security teams should monitor for credential reuse attempts from affected accounts. Given the lack of SSL, any interaction with this domain should be treated as high-risk, and users should be educated on identifying similar phishing infrastructure, such as Cloudflare-hosted pages with anomalous creation dates or missing certificates.