efd4a91b[.]ajkevmslay[.]pages[.]dev

Analysis as of July 23, 2026 indicates that the domain efd4a91b.ajkevmslay.pages.dev was provisioned on February 21, 2026 and is hosted behind Cloudflare's infrastructure (AS13335). The domain resolves to the IP address 188.114.96.3, which belongs to Cloudflare’s network located in the United States. No TLS certificate is presented; the site is served without HTTPS. The page title returned from the HTTP response is “Suspected phishing site | Cloudflare”, which suggests that Cloudflare has flagged the content as malicious.

VirusTotal has recorded 12 positive detections out of 93 scanned engines, confirming that a subset of security vendors consider the domain malicious. The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy feed. Current network measurements show the host is offline, which may be a temporary takedown or a deliberate shutdown by the operators.

The available evidence does not disclose the specific target brand, the phishing kit used, or the exact payload delivered. Consequently, defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑appearance of the hostname or its IP address, and consider adding the IP 188.114.96.3 to reputation‑based blocklists. Ongoing intelligence collection is recommended to capture any future activity, especially if the domain is re‑registered or the underlying IP is repurposed for new campaigns.