# next-4nk.pages.dev — SUSPICIOUS

> next-4nk.pages.dev poses as a legitimate service but is a suspected credential-stealing phishing site hosted on Cloudflare.

## Summary
PhishDestroy identifies next-4nk.pages.dev as a credential-harvesting phishing domain masquerading as a login portal, designed to steal user credentials and session tokens. This site leverages Cloudflare Pages hosting (IP 172.66.44.79) to obfuscate its true origin while presenting a convincing replica of a legitimate login interface. The domain employs a Google Trust Services SSL certificate to further enhance its appearance of legitimacy, tricking users into entering sensitive information under false pretenses.  The technical indicators supporting this assessment include its residence on Cloudflare’s infrastructure, a reputable but often abused hosting provider, and a clean VirusTotal score of 0 detections out of 95 security engines as of the latest scan (seed aa66a3). This absence of detection does not imply safety; rather, it reflects the domain’s recent activation and the evasive tactics employed by its operators, including dynamic DNS and rapid infrastructure rotation. While the exact registration date is not provided, the use of a pages.dev subdomain suggests a recently created or repurposed site, typical of opportunistic phishing campaigns targeting unsuspecting users.  If you have visited next-4nk.pages.dev, immediately cease using any credentials entered on the site and revoke access to any accounts exposed during the visit. Check for unauthorized transactions or login attempts linked to the exposed credentials. Use a password manager to update passwords with strong, unique values and enable multi-factor authentication where possible. Report the domain to your email provider, browser vendor, or platforms like Google Safe Browsing to aid in blocking future access. Avoid interacting with similar domains and verify the authenticity of websites through official channels before submitting sensitive information.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.79

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/67222194-ef97-4eaf-aa00-7389b5879ccf
- PhishDestroy: https://phishdestroy.io/domain/next-4nk.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/next-4nk.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/next-4nk.pages.dev/
Last updated: 2026-03-22