# cloudtxfarm.pages.dev — SUSPICIOUS

> cloudtxfarm.pages.dev poses as a cloud service farm but hosts a generic phishing page. Resolves to 188.114.96.

## Summary
cloudtxfarm.pages.dev is actively hosting a generic phishing campaign designed to mimic legitimate cloud-based services. Threat actors leverage the domain’s association with Cloudflare Pages to lend false credibility to their scam, potentially tricking users into divulging sensitive information or downloading malicious payloads. This domain resolves to IP address 188.114.96.3 and currently shows no detections across 95 VirusTotal scanners, indicating it remains undetected by most antivirus engines as of this advisory.

This domain was registered through Cloudflare, Inc., using Google Trust Services for SSL certification, which can help it evade traditional domain-based blocklists focused on known malicious registrars. Despite appearing legitimate at first glance, the lack of detections does not equate to safety—such domains are often newly observed and rapidly weaponized in phishing, credential harvesting, or malware distribution campaigns. The absence of any VirusTotal flags suggests this threat may be in its early deployment phase, making proactive detection and user awareness critical.

If you’ve visited cloudtxfarm.pages.dev, do not enter any personal or financial information. Disconnect from the site immediately and run a full antivirus scan on your device. Report the domain to your organization’s security team or to abuse@cloudflare.com if you suspect compromise. Monitor your accounts for unusual activity and consider resetting passwords that may have been entered on the site. Cloudflare may suspend malicious subdomains like this one once reported, but user vigilance remains the first line of defense against such evolving threats.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/cloudtxfarm.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/cloudtxfarm.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/cloudtxfarm.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/cloudtxfarm.pages.dev/
Last updated: 2026-04-10