36c96a11[.]demmoo-5p7[.]pages[.]dev

Analysis of the domain 36c96a11.demmoo-5p7.pages.dev indicates a high‑risk credential phishing campaign that has been taken offline. The site was hosted on Cloudflare’s network, resolving to IP address 188.114.97.3, which is assigned to AS13335 Cloudflare, Inc. in the United States. The infrastructure utilizes HSTS and HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS configuration despite the malicious intent. Registration details show the domain was created on September 02, 2020 and was registered through Cloudflare, Inc., with authoritative nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com. An HTTP request to the hostname returned a 403 status code, and the page title presented by the server is "Suspected phishing site | Cloudflare," confirming that Cloudflare’s automated anti‑abuse mechanisms have flagged the content.

VirusTotal scans recorded 10 detections out of 93 security vendors, and the domain is listed on at least one public blocklist. PhishDestroy has also blocked the domain, and Google Safe Browsing flags it for social engineering. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. Defenders should immediately block both the fully qualified domain name and its resolving IP address at perimeter firewalls and DNS filtering solutions. Since the domain is already offline, monitoring for re‑registration or similar sub‑domains under the same Cloudflare account is advisable.

Threat‑intel feeds should be updated to include the observed identifiers – the domain, IP, nameservers, and the Google Trust Services certificate fingerprint – to aid in early detection of any resurgence. Continuous querying of Cloudflare’s API for new zones associated with the same account may provide early warning of future campaigns.